Event detection from signal data removing private information

ABSTRACT

The present invention extends to methods, systems, and computer program products for event detection from signal data removing private information. A signal is ingested. A portion of the signal is selected from within the signal. A first score is computed from the selected portion. The first score indicates a likelihood of the signal including information related to an event type. It is determined that processing of another signal is warranted based on the indicated likelihood. Resources are allocated to process the other signal. The other signal is ingested. Parameters associated with the other signal are accessed. A second score is computed from the parameters utilizing the allocated resources. A previously unidentified event of the event type is identified based on the second score and utilizing the allocated resources. A privacy infrastructure spans signal ingestion, event detection, and event notification and protects the integrity of private information.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a Continuation-in-Part of U.S. patent applicationSer. No. 16/742,045, entitled “Detecting An Event From Signal Data”,filed Jan. 14, 2020 which is incorporated herein in its entirety. Thatapplication is a continuation of U.S. patent application Ser. No.16/560,238, now U.S. Pat. No. 10,581,945, entitled “Detecting An EventFrom Signal Data”, filed Sep. 4, 2019. That application is aContinuation-in-Part of U.S. patent application Ser. No. 16/390,297, nowU.S. Pat. No. 10,447,750, entitled “Detecting Events From IngestedCommunication Signals”, filed Apr. 22, 2019 which is incorporated hereinin its entirety. That application is a Continuation of U.S. patentapplication Ser. No. 16/101,208, now U.S. Pat. No. 10, 313, 413,entitled “Detecting Events From Ingested Communication Streams”, filedAug. 10, 2018 which is incorporated herein in its entirety. Thatapplication claims the benefit of U.S. Provisional Patent ApplicationSer. No. 62/550,797, entitled “Event Detection System and Method”, filedAug. 28, 2017 which is incorporated herein in its entirety.

This application is related to U.S. Provisional Patent Application Ser.No. 62/664,001, entitled “Normalizing Different Types Of IngestedSignals Into A Common Format”, filed Apr. 27, 2018 which is incorporatedherein in its entirety. This application is related to U.S. ProvisionalPatent Application Ser. No. 62/667,616, entitled “Normalizing DifferentTypes Of Ingested Signals Into A Common Format”, filed May 7, 2018 whichis incorporated herein in its entirety. This application is related toU.S. Provisional Patent Application Ser. No. 62/686,791 entitled,“Normalizing Signals”, filed Jun. 19, 2018 which is incorporated hereinin its entirety.

BACKGROUND 1. Background and Relevant Art

Data provided to computer systems can come from any number of differentsources, such as, for example, user input, files, databases,applications, sensors, social media systems, cameras, emergencycommunications, etc. In some environments, computer systems receive(potentially large volumes of) data from a variety of different domainsand/or verticals in a variety of different formats. When data isreceived from different sources and/or in different formats, it can bedifficult to efficiently and effectively derive intelligence from thedata.

Extract, transform, and load (ETL) refers to a technique that extractsdata from data sources, transforms the data to fit operational needs,and loads the data into an end target. ETL systems can be used tointegrate data from multiple varied sources, such as, for example, fromdifferent vendors, hosted on different computer systems, etc.

ETL is essentially an extract and then store process. Prior toimplementing an ETL solution, a user defines what (e.g., subset of) datais to be extracted from a data source and a schema of how the extracteddata is to be stored. During the ETL process, the defined (e.g., subsetof) data is extracted, transformed to the form of the schema (i.e.,schema is used on write), and loaded into a data store. To accessdifferent data from the data source, the user has to redefine what datais to be extracted. To change how data is stored, the user has to definea new schema.

ETL is beneficially because it allows a user to access a desired portionof data in a desired format. However, ETL can be cumbersome as dataneeds evolve. Each change to the extracted data and/or the data storageresults in the ETL process having to be restarted. Further, ETL can bedifficult to implement with streaming data types.

BRIEF SUMMARY

Examples extend to methods, systems, and computer program products forevent detection from signal data removing private information.

A privacy infrastructure spans other modules used for signal ingestion,event detection, and event notification. The privacy infrastructure canremove portions of private information in any of: data streams, rawsignals, normalized signals, events, or event notifications prior to,during, or after any of: signal ingestion, event detection, or eventnotification.

A data stream including private information is ingested. The privacyinfrastructure removes at least a portion of the private informationfrom the data stream. A first score is computed from a portion of thedata stream. The first score indicates a likelihood of the data streamincluding event information related to an event type.

It is determined that further processing of the data stream portion iswarranted based on the likelihood indicated by the first score.Computing resources are allocated to further process the data streamportion. A second score is computed from parameters of the data streamportion utilizing the allocated computing resources. A previouslyunidentified event of the event type is detected based on the secondscore.

The privacy infrastructure may remove none, some, or all of the privateinformation from a data stream prior to event detection and/or duringevent detection and/or after event detection. Thus, a detected event maynot include any private information. Alternately, a detected event caninclude at a least a subset of the private information included in adata stream.

This summary is provided to introduce a selection of concepts in asimplified form that are further described below in the DetailedDescription. This Summary is not intended to identify key features oressential features of the claimed subject matter, nor is it intended tobe used as an aid in determining the scope of the claimed subjectmatter.

Additional features and advantages will be set forth in the descriptionwhich follows, and in part will be obvious from the description, or maybe learned by practice. The features and advantages may be realized andobtained by means of the instruments and combinations particularlypointed out in the appended claims. These and other features andadvantages will become more fully apparent from the followingdescription and appended claims, or may be learned by practice as setforth hereinafter.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to describe the manner in which the above-recited and otheradvantages and features can be obtained, a more particular descriptionwill be rendered by reference to specific implementations thereof whichare illustrated in the appended drawings. Understanding that thesedrawings depict only some implementations and are not therefore to beconsidered to be limiting of its scope, implementations will bedescribed and explained with additional specificity and detail throughthe use of the accompanying drawings in which:

FIG. 1A illustrates an example computer architecture that facilitatesnormalizing ingesting signals.

FIG. 1B illustrates an example computer architecture that facilitatesdetecting events from normalized signals.

FIG. 1C illustrates the example computer architecture of FIG. 1B andincludes a privacy infrastructure.

FIG. 2 illustrates a flow chart of an example method for normalizingingested signals.

FIG. 3 illustrates a flow chart of an example method for ingesting acommunication stream and detecting an event.

FIG. 4 illustrates an example computer architecture that facilitatesgenerating event scores from ingested communication streams.

FIG. 5 illustrates a flow chart of an example method for generating anevent score from an ingested communication stream.

FIGS. 6A and 6B are example syntaxes for a first and a secondcommunication channel, respectively.

FIG. 7 is an example of event scoring based on historic parameter valuesfor a geographic region.

FIG. 8 a computer architecture that facilitates concurrently handlingcommunication signals from a plurality of channels.

FIG. 9 illustrates an example computer architecture that facilitatesdetecting an event from scores generated from ingested signals.

FIG. 10 illustrates a flow chart of an example method for detecting anevent from scores generated from ingested signals.

DETAILED DESCRIPTION

Examples extend to methods, systems, and computer program products forevent detection from signal data removing private information.

Entities (e.g., parents, other family members, guardians, friends,teachers, social workers, first responders, hospitals, deliveryservices, media outlets, government entities, etc.) may desire to bemade aware of relevant events as close as possible to the events'occurrence (i.e., as close as possible to “moment zero”). Differenttypes of ingested signals (e.g., social media signals, web signals, andstreaming signals) can be used to detect events. Aspects of theinvention ingest and process a plurality of audio streams, such as audiostreams from communication channels used by local municipalities,counties, states, countries, or other regional subdivisions. Signalingestion and processing can be performed in real- or near-real time(e.g., with no or near-zero latency), but can alternatively oradditionally be performed asynchronously from audio stream generation orreceipt.

More particularly, in one aspect, an event is detected based oncharacteristics of a communication (e.g., audio) stream. For example, anemergency event of interest, such as a shooting, bombing, riot, or otheremergency event, that has (or will) occur is detected based on analysisof emergency communications. In another example, logistical parameters(e.g., location, time, operating context, etc.) are determined for eachoperator within an operator fleet. In a further example, logisticalparameters, such as, bed availability, are determined for one or morepublic and/or private care/treatment facilities. Event parameters, suchas the event location (e.g., specific geolocation, geographic region,etc.), the event time (e.g., start and/or stop), the event severity,event participants, or any other suitable parameter can also bedetermined. These event parameters can be fed into an event detectionsystem that can be used to: gather additional information about theevent, to notify entities, such as emergency personnel, securitypersonnel, financial institutions, or other entities interested in theevent, to reroute fleet vehicles, etc.

A variety of challenges arise when processing streaming communicationchannels and other signals. A relatively large amount of computingresources (e.g., uptime and power) may be consumed to continuallymonitor and analyze communication on a communication channel. Resourceconsumption scales directly with the number of communication channelsmonitored and becomes commercially and technically unfeasible after athreshold number of communication channels are ingested. Further,different jurisdictions, corporations, etc. can use different syntax,vocabulary, and/or language from other jurisdictions, corporations,etc., which reduces or eliminates the ability to process multiplecommunication channels using the same processes (and further increasingthe amount of required computing resources).

Communications on said channels also tend to be noisy, which decreasethe quality of the event signal extracted from said communications.Additionally, a single communication channel can concurrently havemultiple ongoing conversations (e.g., between the dispatcher andmultiple field operators), which may need to be separated out for eventanalysis. Furthermore, not all of the conversations are relevant (e.g.,about an event). For example, some conversations may be idle banter,while others may be about low-level incidents that do not rise to thelevel of an event.

Aspects of the invention mitigate, reduce, and potentially fully resolveone or more of the described challenges. A smaller portion of a signal,for example, a clip or sub-clip, is examined. Based on the likelihood ofthe smaller portion containing event related information, a decision ismade whether to examine the signal more thoroughly or to examine another(possibly related) signal. That is, a less resource intensiveexamination of a signal is performed to estimate the benefit ofperforming a subsequent more resource intensive examination of thesignal or of another signal.

For example, aspects can decrease computing resource consumption byidentifying and analyzing smaller portions of a signal (as opposed tolarger portions or the entire signal). This minimizes compute power byreducing the volume of data to be analyzed (e.g., a subset of the signalinstead of the entire signal). Additionally, or alternatively, computingresource consumption is decreased by pre-evaluating parts of a signalfor an event content probability. The event content probability can thenbe used to determine the potential benefit of more thoroughly examiningthe signal or another signal.

Examining signal portions also conserves compute power and timeresources by limiting application of resource-intensive processes (e.g.,signal interpretation, voice recognition, NLP, etc.) to a subset ofportions with a higher probability of having event-associated content.Additionally, or alternatively, computing resource consumption isreduced by leveraging standardized syntax for each jurisdiction,corporation, communication channel, or dispatcher. Processing of signalscan focus on signal portions with the highest probability of having anevent identifier (e.g., event code which gives an indication of whetherthe clip is about an event, the event type, and/or event severity).

In one aspect, different analysis modules can be used for each differentcommunication channel. Using different analysis modules increases theprocessing speed of each communication stream, since smaller,lighter-weight modules can be used for each clip analysis instead ofusing a larger, slower module that accommodates nuances of multiplecommunication channels. In one example, each communication channel canbe associated with its own module(s) that identifies the eventidentifier clip or sub-clip, extracts event parameters from the clip orsub-clip, or performs any other analysis. These modules are preferablytrained on historic communication clips from the respectivecommunication channel but can be trained using other communication clipsor otherwise trained.

Noise-reduction processes can be applied on the communication streamsbefore the clips are identified, which functions to clean up thesubsequently processed signal. For example, the system and method canremove white noise, static, scratches, pops, chirps, or other featuresprior to clip analysis. Conversation analysis (e.g., NLP analysis),voice recognition, or other techniques to can be applied to stitchtogether different conversations on the same communication channel.

In general, signal ingestion modules ingest different types of rawstructured and/or raw unstructured signals on an ongoing basis.Different types of signals can include different data media types anddifferent data formats. Data media types can include audio, video,image, and text. Different formats can include text in XML, text inJavaScript Object Notation (JSON), database formats, text in RSS feed,plain text, video stream in Dynamic Adaptive Streaming over HTTP (DASH),video stream in HTTP Live Streaming (HLS), video stream in Real-TimeMessaging Protocol (RTMP), other Multipurpose Internet Mail Extensions(MIME) types, audio stream in Free Lossless Audio Codec (“FLAC”), audiostream in Waveform Audio File Format (WAV), audio stream in AppleLossless Audio Codec (“ALAC”) etc. Handling different types and formatsof data introduces inefficiencies into subsequent event detectionprocesses, including when determining if different signals relate to thesame event.

Accordingly, the signal ingestion modules can normalize raw signalsacross multiple data dimensions to form normalized signals. Eachdimension can be a scalar value or a vector of values. In one aspect,raw signals are normalized into normalized signals having a Time,Location, Context (or “TLC”) dimensions.

A Time (T) dimension can include a time of origin or alternatively a“event time” of a signal. A Location (L) dimension can include alocation anywhere across a geographic area, such as, a country (e.g.,the United States), a State, a defined area, an impacted area, an areadefined by a geo cell, an address, etc.

A Context (C) dimension indicates circumstances surroundingformation/origination of a raw signal in terms that facilitateunderstanding and assessment of the raw signal. The Context (C)dimension of a raw signal can be derived from express as well asinferred signal features of the raw signal.

Signal ingestion modules can include one or more single sourceclassifiers. A single source classifier can compute a single sourceprobability for a raw signal from features of the raw signal. A singlesource probability can reflect a mathematical probability orapproximation of a mathematical probability (e.g., a percentage between0%-100%) of an event actually occurring. A single source classifier canbe configured to compute a single source probability for a single eventtype or to compute a single source probability for each of a pluralityof different event types. A single source classifier can compute asingle source probability using artificial intelligence, machinelearning, neural networks, logic, heuristics, etc.

As such, single source probabilities and corresponding probabilitydetails can represent a Context (C) dimension. Probability details canindicate (e.g., can include a hash field indicating) a probabilisticmodel and (express and/or inferred) signal features considered in asignal source probability calculation.

Thus, per signal type, signal ingestion modules determine Time (T), aLocation (L), and a Context (C) dimensions associated with a signal.Different ingestion modules can be utilized/tailored to determine T, L,and C dimensions associated with different signal types. Normalized (or“TLC”) signals can be forwarded to an event detection infrastructure.When signals are normalized across common dimensions subsequent eventdetection is more efficient and more effective.

Normalization of ingestion signals can include dimensionality reduction.Generally, “transdimensionality” transformations can be structured anddefined in a “TLC” dimensional model. Signal ingestion modules can applythe “transdimensionality” transformations to generic source data in rawsignals to re-encode the source data into normalized data having lowerdimensionality. Thus, each normalized signal can include a T vector, anL vector, and a C vector. At lower dimensionality, the complexity ofmeasuring “distances” between dimensional vectors across differentnormalized signals is reduced.

Concurrently with signal ingestion, an event detection infrastructureconsiders features of different combinations of normalized signals toattempt to identify events of interest to various parties. For example,the event detection infrastructure can determine that features ofmultiple different normalized signals collectively indicate an event ofinterest to one or more parties. Alternately, the event detectioninfrastructure can determine that features of one or more normalizedsignals indicate a possible event of interest to one or more parties.The event detection infrastructure then determines that features of oneor more other normalized signals validate the possible event as anactual event of interest to the one or more parties. Signal features caninclude: signal type, signal source, signal content, Time (T) dimension,Location (L) dimension, Context (C) dimension, other circumstances ofsignal creation, etc.

In one aspect, streaming communication signals are received on one ormore communication channels. Characteristics of the streamingcommunication signals can be used (potentially in combination with othersignals) to detect events.

In some aspects, any of data streams, raw signals, normalized signals,events, or event notifications can include information (privateinformation, user information, etc.) deemed inappropriate for furtherpropagation. A privacy infrastructure can span other modules used fordata stream processing, signal ingestion, event detection, and eventnotification. The privacy infrastructure can use various mechanisms toprevent other modules from inappropriately propagating information. Forexample, the privacy infrastructure can remove or otherwise (temporarilyor permanently) obscure information in any of: data streams, rawsignals, normalized signals, events, or event notifications prior to,during, or after any of: signal ingestion, event detection, or eventnotification.

In general, signals, including raw signals, data streams, and normalizedsignals, can include information deemed inappropriate for propagation.The privacy infrastructure can prevent the information from beinginappropriately propagated prior to, during, or after event detection.Information deemed inappropriate for propagation can include:confidential information, patient information, personally identifiableinformation (PII), personal health information (PHI), sensitive personalinformation (SPI), Payment Card Industry information (PCI), or otherprivate information, etc. (collectively, “user information”). Preventingpropagation of user information can include removing (e.g., scrubbing orstripping) the user information from ingested signals. Removal of userinformation prior to event detection allows events to be detected whilesignificantly increasing the privacy of any entities (e.g., individuals,businesses, etc.) referenced within the user information.

Data scrubbing or stripping can include the removal or permanentdestruction of certain information. As compared to dataanonymization—which may involve complex methods of obfuscation—datascrubbing eliminates information from the system. That is, scrubbed datais not merely aggregated in a manner that delinks it from other data,rather, scrubbed data is permanently eliminated.

In one aspect, user information is included in metadata within aningested raw signal (which may be a data stream). The privacyinfrastructure can scrub the metadata prior to event detection and/orstorage of the raw signal. For example, the privacy infrastructure canremove associated account information from a social media post. Theprivacy infrastructure can also scrub (or otherwise remove) geocodedinformation included in an ingested raw signal metadata.

The privacy infrastructure can actively attempt to identify userinformation in ingested raw signals and/or normalized signals. Forexample, the privacy infrastructure can parse attributes of an ingestedraw signal or normalized signal (including signal content) searching foruser information, such as, names, birthdates, physical characteristics,etc. The privacy infrastructure can scrub (or otherwise remove) anyidentified user information. For example, the privacy infrastructure canscrub PII included in a Computer Aided Dispatch (CAD) signal prior toutilizing the CAD signal for event detection.

Certain types of data may be inherently personal but are also used forevent detection. For example, in an emergency situation involving asuspected perpetrator, it may be appropriate (and even beneficial) topropagate identifying physical characteristics (or other userinformation) included in a signal to law enforcement. The physicalcharacteristics (or other user information) may remain with the signalbut the signal may be tagged to indicate the presence of the physicalcharacteristics. The privacy infrastructure may apply various securitymechanisms on signals tagged as including user information. Securitymechanisms can include segregating the tagged signal from other signals,applying encryption (or higher encryption) to the tagged signal,applying access controls (e.g., user-based, entity-based, purpose-based,time-based, warrant-based, etc.) to the tagged signal, or otherwiseimplementing rules regarding activities that are authorized/appropriatefor the tagged signal.

The privacy infrastructure can implement mechanisms to remove (orotherwise obscure) user information in accordance with one or more of:time-domain, expiry, or relevance-based rules. In one aspect, some userinformation may be appropriate to retain for a (e.g., relatively short)period of time. However, after the period of time, retention of the userinformation is no longer appropriate. The privacy infrastructure canimplement a time based rule to remove (or otherwise obscure) the userinformation when the time period expires. For example, in a healthcaresetting, it may be appropriate to know the identity of a person whotests positive for a communicable disease during the time in which thedisease is communicable to others. However, once the person is no longercontagious, the identity loses relevance, and the privacy infrastructurecan scrub the identify while maintaining other, non-user-identifiableinformation about the case.

In another aspect, the privacy infrastructure can retain information ona rolling window of time, for example 24 hours. For example, an accesslog for a resource (e.g., a building, a file, a computer, etc.) may beretained for a set period of time. Once the period of time has expiredfor a specific record, user information may be scrubbed from the accessrecord while maintaining non-identifiable information (e.g., anindication that the resource was accessed).

In further aspect, the privacy infrastructures can obscure userinformation at multiple layers to further protect a user's privacy evenduring a period of time in which their user information is retained. Forexample, a data provider may hide, modify, encrypt, hash, or otherwiseobscure user information prior to transfer into a system. The eventdetection algorithms previously described may be employed to identifysimilarities among signal characteristics even with the data within thesignals has been arbitrarily assigned. That is, event detection maystill be possible based on a uniform obfuscation of data prior toingestion within the system. In this way, user data within the eventdetection system may not be traceable back to a user without also havingaccess to the entirely separate system operated by the entity providingthe signal. This may improve user privacy.

To further improve user privacy, the privacy infrastructure can combinereceiving pre-obscured data from a signal provider with a process ofapplying an additional local obfuscation. For example, a signal sourcemay provide only a hashed version of a user identifier to the signalingestion system. The hashed version of the user identified may behashed according to a method unknown to the signal ingestion system(e.g., a private key, salt, or the like). Upon receipt, the privacyinfrastructure may apply an additional obfuscation (e.g., a secondprivate key, salt, or the like) to the received data using a methodunknown to the signal provider. As described, the privacy infrastructuremay then scrub, cancel, or delete any connection between the receiveddata (already obfuscated), and the secondary local modificationaccording to a time-window, expiry, relevance, etc., rules.

Implementations can comprise or utilize a special purpose orgeneral-purpose computer including computer hardware, such as, forexample, one or more computer and/or hardware processors (including anyof Central Processing Units (CPUs), and/or Graphical Processing Units(GPUs), general-purpose GPUs (GPGPUs), Field Programmable Gate Arrays(FPGAs), application specific integrated circuits (ASICs), TensorProcessing Units (TPUs)) and system memory, as discussed in greaterdetail below. Implementations also include physical and othercomputer-readable media for carrying or storing computer-executableinstructions and/or data structures. Such computer-readable media can beany available media that can be accessed by a general purpose or specialpurpose computer system. Computer-readable media that storecomputer-executable instructions are computer storage media (devices).Computer-readable media that carry computer-executable instructions aretransmission media. Thus, by way of example, and not limitation,implementations can comprise at least two distinctly different kinds ofcomputer-readable media: computer storage media (devices) andtransmission media.

Computer storage media (devices) includes RAM, ROM, EEPROM, CD-ROM,Solid State Drives (“SSDs”) (e.g., RAM-based or Flash-based), ShingledMagnetic Recording (“SMR”) devices, Flash memory, phase-change memory(“PCM”), other types of memory, other optical disk storage, magneticdisk storage or other magnetic storage devices, or any other mediumwhich can be used to store desired program code means in the form ofcomputer-executable instructions or data structures and which can beaccessed by a general purpose or special purpose computer.

In one aspect, one or more processors are configured to executeinstructions (e.g., computer-readable instructions, computer-executableinstructions, etc.) to perform any of a plurality of describedoperations. The one or more processors can access information fromsystem memory and/or store information in system memory. The one or moreprocessors can (e.g., automatically) transform information betweendifferent formats, such as, for example, between any of: raw signals,streaming signals, communication signals, audio signals, normalizedsignals, search terms, geo cell subsets, events, clips, sub-clips, clipscores, event identifiers, parameters, event scores, probabilities,notifications, etc.

System memory can be coupled to the one or more processors and can storeinstructions (e.g., computer-readable instructions, computer-executableinstructions, etc.) executed by the one or more processors. The systemmemory can also be configured to store any of a plurality of other typesof data generated and/or transformed by the described components, suchas, for example, raw signals, streaming signals, communication signals,audio signals, normalized signals, search terms, geo cell subsets,events, clips, sub-clips, clip scores, event identifiers, parameters,event scores, probabilities, notifications, etc.

A “network” is defined as one or more data links that enable thetransport of electronic data between computer systems and/or modulesand/or other electronic devices. When information is transferred orprovided over a network or another communications connection (eitherhardwired, wireless, or a combination of hardwired or wireless) to acomputer, the computer properly views the connection as a transmissionmedium. Transmissions media can include a network and/or data linkswhich can be used to carry desired program code means in the form ofcomputer-executable instructions or data structures and which can beaccessed by a general purpose or special purpose computer. Combinationsof the above should also be included within the scope ofcomputer-readable media.

Further, upon reaching various computer system components, program codemeans in the form of computer-executable instructions or data structurescan be transferred automatically from transmission media to computerstorage media (devices) (or vice versa). For example,computer-executable instructions or data structures received over anetwork or data link can be buffered in RAM within a network interfacemodule (e.g., a “NIC”), and then eventually transferred to computersystem RAM and/or to less volatile computer storage media (devices) at acomputer system. Thus, it should be understood that computer storagemedia (devices) can be included in computer system components that also(or even primarily) utilize transmission media.

Computer-executable instructions comprise, for example, instructions anddata which, in response to execution at a processor, cause a generalpurpose computer, special purpose computer, or special purposeprocessing device to perform a certain function or group of functions.The computer executable instructions may be, for example, binaries,intermediate format instructions such as assembly language, or evensource code. Although the subject matter has been described in languagespecific to structural features and/or methodological acts, it is to beunderstood that the subject matter defined in the appended claims is notnecessarily limited to the described features or acts described above.Rather, the described features and acts are disclosed as example formsof implementing the claims.

Those skilled in the art will appreciate that the described aspects maybe practiced in network computing environments with many types ofcomputer system configurations, including, personal computers, desktopcomputers, laptop computers, message processors, hand-held devices,wearable devices, multicore processor systems, multi-processor systems,microprocessor-based or programmable consumer electronics, network PCs,minicomputers, mainframe computers, mobile telephones, PDAs, tablets,routers, switches, and the like. The described aspects may also bepracticed in distributed system environments where local and remotecomputer systems, which are linked (either by hardwired data links,wireless data links, or by a combination of hardwired and wireless datalinks) through a network, both perform tasks. In a distributed systemenvironment, program modules may be located in both local and remotememory storage devices.

Further, where appropriate, functions described herein can be performedin one or more of: hardware, software, firmware, digital components, oranalog components. For example, one or more Field Programmable GateArrays (FPGAs) and/or one or more application specific integratedcircuits (ASICs) and/or one or more Tensor Processing Units (TPUs) canbe programmed to carry out one or more of the systems and proceduresdescribed herein. Hardware, software, firmware, digital components, oranalog components can be specifically tailor-designed for a higher speeddetection or artificial intelligence that can enable signal processing.In another example, computer code is configured for execution in one ormore processors, and may include hardware logic/electrical circuitrycontrolled by the computer code. These example devices are providedherein purposes of illustration, and are not intended to be limiting.Embodiments of the present disclosure may be implemented in furthertypes of devices.

The described aspects can also be implemented in cloud computingenvironments. In this description and the following claims, “cloudcomputing” is defined as a model for enabling on-demand network accessto a shared pool of configurable computing resources. For example, cloudcomputing can be employed in the marketplace to offer ubiquitous andconvenient on-demand access to the shared pool of configurable computingresources (e.g., compute resources, networking resources, and storageresources). The shared pool of configurable computing resources can beprovisioned via virtualization and released with low effort or serviceprovider interaction, and then scaled accordingly.

A cloud computing model can be composed of various characteristics suchas, for example, on-demand self-service, broad network access, resourcepooling, rapid elasticity, measured service, and so forth. A cloudcomputing model can also expose various service models, such as, forexample, Software as a Service (“SaaS”), Platform as a Service (“PaaS”),and Infrastructure as a Service (“IaaS”). A cloud computing model canalso be deployed using different deployment models such as privatecloud, community cloud, public cloud, hybrid cloud, and so forth. Inthis description and in the following claims, a “cloud computingenvironment” is an environment in which cloud computing is employed.

In this description and the following claims, a “geo cell” is defined asa piece of “cell” in a spatial grid in any form. In one aspect, geocells are arranged in a hierarchical structure. Cells of differentgeometries can be used.

A “geohash” is an example of a “geo cell”.

In this description and the following claims, “geohash” is defined as ageocoding system which encodes a geographic location into a short stringof letters and digits. Geohash is a hierarchical spatial data structurewhich subdivides space into buckets of grid shape (e.g., a square).Geohashes offer properties like arbitrary precision and the possibilityof gradually removing characters from the end of the code to reduce itssize (and gradually lose precision). As a consequence of the gradualprecision degradation, nearby places will often (but not always) presentsimilar prefixes. The longer a shared prefix is, the closer the twoplaces are. geo cells can be used as a unique identifier and toapproximate point data (e.g., in databases).

In one aspect, a “geohash” is used to refer to a string encoding of anarea or point on the Earth. The area or point on the Earth may berepresented (among other possible coordinate systems) as alatitude/longitude or Easting/Northing—the choice of which is dependenton the coordinate system chosen to represent an area or point on theEarth. geo cell can refer to an encoding of this area or point, wherethe geo cell may be a binary string comprised of 0s and 1s correspondingto the area or point, or a string comprised of 0s, 1s, and a ternarycharacter (such as X)—which is used to refer to a don't care character(0 or 1). A geo cell can also be represented as a string encoding of thearea or point, for example, one possible encoding is base-32, whereevery 5 binary characters are encoded as an ASCII character.

Depending on latitude, the size of an area defined at a specified geocell precision can vary. When geohash is used for spatial indexing, theareas defined at various geo cell precisions are approximately:

TABLE 1 Example Areas at Various Geo Cell Precisions geo cellLength/Precision width × height 1 5,009.4 km × 4,992.6 km 2 1,252.3 km ×624.1 km   3 156.5 km × 156 km   4 39.1 km × 19.5 km 5 4.9 km × 4.9 km 6 1.2 km × 609.4 m 7 152.9 m × 152.4 m 8 38.2 m × 19 m   9 4.8 m × 4.8 m10  1.2 m × 59.5 cm 11 14.9 cm × 14.9 cm 12 3.7 cm × 1.9 cm

Other geo cell geometries, such as, hexagonal tiling, triangular tiling,etc. are also possible. For example, the H3 geospatial indexing systemis a multi-precision hexagonal tiling of a sphere (such as the Earth)indexed with hierarchical linear indexes.

In another aspect, geo cells are a hierarchical decomposition of asphere (such as the Earth) into representations of regions or pointsbased a Hilbert curve (e.g., the S2 hierarchy or other hierarchies).Regions/points of the sphere can be projected into a cube and each faceof the cube includes a quad-tree where the sphere point is projectedinto. After that, transformations can be applied and the spacediscretized. The geo cells are then enumerated on a Hilbert Curve (aspace-filling curve that converts multiple dimensions into one dimensionand preserves the approximate locality).

Due to the hierarchical nature of geo cells, any signal, event, entity,etc., associated with a geo cell of a specified precision is by defaultassociated with any less precise geo cells that contain the geo cell.For example, if a signal is associated with a geo cell of precision 9,the signal is by default also associated with corresponding geo cells ofprecisions 1, 2, 3, 4, 5, 6, 7, and 8. Similar mechanisms are applicableto other tiling and geo cell arrangements. For example, S2 has a celllevel hierarchy ranging from level zero (85,011,012 km²) to level 30(between 0.48 cm² to 0.96 cm²).

Signal Ingestion and Normalization

Signal ingestion modules ingest a variety of raw structured and/or rawunstructured signals on an on going basis and in essentially real-time.Raw signals can include social posts, live broadcasts, traffic camerafeeds, other camera feeds (e.g., from other public cameras or from CCTVcameras), listening device feeds, 911 calls, weather data, plannedevents, IoT device data, crowd sourced traffic and road information,satellite data, air quality sensor data, smart city sensor data, publicradio communication (e.g., among first responders and/or dispatchers,between air traffic controllers and pilots), etc. The content of rawsignals can include images, video, audio, text, etc.

In general, signal normalization can prepare (or pre-process) rawsignals into normalized signals to increase efficiency and effectivenessof subsequent computing activities, such as, event detection, eventnotification, etc., that utilize the normalized signals. For example,signal ingestion modules can normalize raw signals into normalizedsignals having a Time, Location, and Context (TLC) dimensions. An eventdetection infrastructure can use the Time, Location, and Contentdimensions to more efficiently and effectively detect events.

Per signal type and signal content, different normalization modules canbe used to extract, derive, infer, etc. Time, Location, and Contextdimensions from/for a raw signal. For example, one set of normalizationmodules can be configured to extract/derive/infer Time, Location andContext dimensions from/for social signals. Another set of normalizationmodules can be configured to extract/derive/infer Time, Location andContext dimensions from/for Web signals. A further set of normalizationmodules can be configured to extract/derive/infer Time, Location andContext dimensions from/for streaming signals.

Normalization modules for extracting/deriving/inferring Time, Location,and Context dimensions can include text processing modules, NLP modules,image processing modules, video processing modules, etc. The modules canbe used to extract/derive/infer data representative of Time, Location,and Context dimensions for a signal. Time, Location, and Contextdimensions for a signal can be extracted/derived/inferred from metadataand/or content of the signal.

For example, NLP modules can analyze metadata and content of a soundclip to identify a time, location, and keywords (e.g., fire, shooter,etc.). An acoustic listener can also interpret the meaning of sounds ina sound clip (e.g., a gunshot, vehicle collision, etc.) and convert torelevant context. Live acoustic listeners can determine the distance anddirection of a sound. Similarly, image processing modules can analyzemetadata and pixels in an image to identify a time, location andkeywords (e.g., fire, shooter, etc.). Image processing modules can alsointerpret the meaning of parts of an image (e.g., a person holding agun, flames, a store logo, etc.) and convert to relevant context. Othermodules can perform similar operations for other types of contentincluding text and video.

Per signal type, each set of normalization modules can differ but mayinclude at least some similar modules or may share some common modules.For example, similar (or the same) image analysis modules can be used toextract named entities from social signal images and public camerafeeds. Likewise, similar (or the same) NLP modules can be used toextract named entities from social signal text and web text.

In some aspects, an ingested signal includes sufficient expresslydefined time, location, and context information upon ingestion. Theexpressly defined time, location, and context information is used todetermine Time, Location, and Context dimensions for the ingestedsignal. In other aspects, an ingested signal lacks expressly definedlocation information or expressly defined location information isinsufficient (e.g., lacks precision) upon ingestion. In these otheraspects, Location dimension or additional Location dimension can beinferred from features of an ingested signal and/or through referencesto other data sources. In further aspects, an ingested signal lacksexpressly defined context information or expressly defined contextinformation is insufficient (e.g., lacks precision) upon ingestion. Inthese further aspects, Context dimension or additional Context dimensioncan be inferred from features of an ingested signal and/or throughreference to other data sources.

In further aspects, time information may not be included, or includedtime information may not be given with high enough precision and Timedimension is inferred. For example, a user may post an image to a socialnetwork which had been taken some indeterminate time earlier.

Normalization modules can use named entity recognition and reference toa geo cell database to infer Location dimension. Named entities can berecognized in text, images, video, audio, or sensor data. The recognizednamed entities can be compared to named entities in geo cell entries.Matches indicate possible signal origination in a geographic areadefined by a geo cell.

As such, a normalized signal can include a Time dimension, a Locationdimension, a Context dimension (e.g., single source probabilities andprobability details), a signal type, a signal source, and content.

A single source probability can be calculated by single sourceclassifiers (e.g., machine learning models, artificial intelligence,neural networks, statistical models, etc.) that consider hundreds,thousands, or even more signal features of a signal. Single sourceclassifiers can be based on binary models and/or multi-class models.

FIG. 1A depicts part of computer architecture 100 that facilitatesingesting and normalizing signals. As depicted, computer architecture100 includes signal ingestion modules 101 and raw signals 121, includingsocial signals 171, Web signals 172, and streaming signals 173. Rawsignals 121 can also include other signal types, including databasesignals. Raw signals 121, including signal ingestion modules 101, socialsignals 171, Web signals 172, streaming signals 173, and other signaltypes can be connected to (or be part of) a network, such as, forexample, a system bus, a Local Area Network (“LAN”), a Wide Area Network(“WAN”), and even the Internet. Accordingly, raw signals 121, includingsignal ingestion modules 101, social signals 171, Web signals 172,streaming signals 173, and other signal types as well as any otherconnected computer systems and their components can create and exchangemessage related data (e.g., Internet Protocol (“IP”) datagrams and otherhigher layer protocols that utilize IP datagrams, such as, TransmissionControl Protocol (“TCP”), Hypertext Transfer Protocol (“HTTP”), SimpleMail Transfer Protocol (“SMTP”), Simple Object Access Protocol (SOAP),etc. or using other non-datagram protocols) over the network.

Signal ingestion module(s) 101 can ingest raw signals 121, includingsocial signals 171, web signals 172, streaming signals 173, and othersignal types (e.g., social posts, traffic camera feeds, other camerafeeds, listening device feeds, 911 calls, weather data, planned events,IoT device data, crowd sourced traffic and road information, satellitedata, air quality sensor data, smart city sensor data, public radiocommunication, database data, etc.) on an on going basis and inessentially real-time. Signal ingestion module(s) 101 include socialcontent ingestion modules 174, web content ingestion modules 175, streamcontent ingestion modules 176, and signal formatter 180. Signalformatter 180 further includes social signal processing module 181, websignal processing module 182, and stream signal processing modules 183.

For each type of signal, a corresponding ingestion module and signalprocessing module can interoperate to normalize the signal into a Time,Location, Context (TLC) dimensions. For example, social contentingestion modules 174 and social signal processing module 181 caninteroperate to normalize social signals 171 into TLC dimensions.Similarly, web content ingestion modules 175 and web signal processingmodule 182 can interoperate to normalize web signals 172 into TLCdimensions. Likewise, stream content ingestion modules 176 and streamsignal processing modules 183 can interoperate to normalize streamingsignals 173 into TLC dimensions.

In one aspect, signal ingestion module(s) 101 also include ingestion andprocessing modules for other signal types, such as, for example,database signals. The database ingestion modules and database processingmodules can interoperate to normalize database signals.

In one aspect, signal content exceeding specified size requirements(e.g., audio or video) is cached upon ingestion. Signal ingestionmodules 101 include a URL or other identifier to the cached contentwithin the context for the signal.

In one aspect, signal formatter 180 includes modules for determining asingle source probability as a ratio of signals turning into eventsbased on the following signal properties: (1) event class (e.g., fire,accident, weather, etc.), (2) media type (e.g., text, image, audio,etc.), (3) source (e.g., twitter, traffic camera, first responder radiotraffic, etc.), and (4) geo type (e.g., geo cell, region, or non-geo).Probabilities can be stored in a lookup table for different combinationsof the signal properties. Features of a signal can be derived and usedto query the lookup table. For example, the lookup table can be queriedwith terms (“accident”, “image”, “twitter”, “region”). The correspondingratio (probability) can be returned from the table.

In another aspect, signal formatter 180 includes a plurality of singlesource classifiers (e.g., artificial intelligence, machine learningmodules, neural networks, etc.). Each single source classifier canconsider hundreds, thousands, or even more signal features of a signal.Signal features of a signal can be derived and submitted to a signalsource classifier. The single source classifier can return a probabilitythat a signal indicates a type of event. Single source classifiers canbe binary classifiers or multi-source classifiers.

Raw classifier output can be adjusted to more accurately represent aprobability that a signal is a “true positive”. For example, 1,000signals whose raw classifier output is 0.9 may include 80% as truepositives. Thus, probability can be adjusted to 0.8 to reflect trueprobability of the signal being a true positive. “Calibration” can bedone in such a way that for any “calibrated score” this score reflectsthe true probability of a true positive outcome.

Signal ingestion modules 101 can insert one or more single sourceprobabilities and corresponding probability details into a normalizedsignal to represent a Context (C) dimension. Probability details canindicate a probabilistic model and features used to calculate theprobability. In one aspect, a probabilistic model and signal featuresare contained in a hash field.

Signal ingestion modules 101 can access “transdimensionality”transformations structured and defined in a “TLC” dimensional model.Signal ingestion modules 101 can apply the “transdimensionality”transformations to generic source data in raw signals to re-encode thesource data into normalized data having lower dimensionality.Dimensionality reduction can include reducing dimensionality of a rawsignal to a normalized signal including a T vector, an L vector, and a Cvector. At lower dimensionality, the complexity of measuring “distances”between dimensional vectors across different normalized signals isreduced.

Thus, in general, any received raw signals can be normalized intonormalized signals including a Time (T) dimension, a Location (L)dimension, a Context (C) dimension, signal source, signal type, andcontent. Signal ingestion modules 101 can send normalized signals 122 toevent detection infrastructure 103.

For example, signal ingestion modules 101 can send normalized signal122A, including time 123A, location 124A, context 126A, content 127A,type 128A, and source 129A to event detection infrastructure 103.Similarly, signal ingestion modules 101 can send normalized signal 122B,including time 123B, location 124B, context 126B, content 127B, type128B, and source 129B to event detection infrastructure 103.

Event Detection

FIG. 1B depicts part of computer architecture 100 that facilitatesdetecting events. As depicted, computer architecture 100 includes geocell database 111 and even notification 116. Geo cell database 111 andevent notification 116 can be connected to (or be part of) a networkwith signal ingestion modules 101 and event detection infrastructure103. As such, geo cell database 111 and even notification 116 can createand exchange message related data over the network.

As described, in general, on an ongoing basis, concurrently with signalingestion (and also essentially in real-time), event detectioninfrastructure 103 detects different categories of (planned andunplanned) events (e.g., fire, police response, mass shooting, trafficaccident, natural disaster, storm, active shooter, concerts, protests,etc.) in different locations (e.g., anywhere across a geographic area,such as, the United States, a State, a defined area, an impacted area,an area defined by a geo cell, an address, etc.), at different timesfrom Time, Location, and Context dimensions included in normalizedsignals. Since, normalized signals are normalized to include Time,Location, and Context dimensions, event detection infrastructure 103 canhandle normalized signals in a more uniform manner increasing eventdetection efficiency and effectiveness.

Event detection infrastructure 103 can also determine an eventtruthfulness, event severity, and an associated geo cell. In one aspect,a Context dimension in a normalized signal increases the efficiency andeffectiveness of determining truthfulness, severity, and an associatedgeo cell.

Generally, an event truthfulness indicates how likely a detected eventis actually an event (vs. a hoax, fake, misinterpreted, etc.).Truthfulness can range from less likely to be true to more likely to betrue. In one aspect, truthfulness is represented as a numerical value,such as, for example, from 1 (less truthful) to 10 (more truthful) or aspercentage value in a percentage range, such as, for example, from 0%(less truthful) to 100% (more truthful). Other truthfulnessrepresentations are also possible. For example, truthfulness can be adimension or represented by one or more vectors.

Generally, an event severity indicates how severe an event is (e.g.,what degree of badness, what degree of damage, etc. is associated withthe event). Severity can range from less severe (e.g., a single vehicleaccident without injuries) to more severe (e.g., multi vehicle accidentwith multiple injuries and a possible fatality). As another example, ashooting event can also range from less severe (e.g., one victim withoutlife threatening injuries) to more severe (e.g., multiple injuries andmultiple fatalities). In one aspect, severity is represented as anumerical value, such as, for example, from 1 (less severe) to 5 (moresevere). Other severity representations are also possible. For example,severity can be a dimension or represented by one or more vectors.

In general, event detection infrastructure 103 can include a geodetermination module including modules for processing different kinds ofcontent including location, time, context, text, images, audio, andvideo into search terms. The geo determination module can query a geocell database with search terms formulated from normalized signalcontent. The geo cell database can return any geo cells having matchingsupplemental information. For example, if a search term includes astreet name, a subset of one or more geo cells including the street namein supplemental information can be returned to the event detectioninfrastructure.

Event detection infrastructure 103 can use the subset of geo cells todetermine a geo cell associated with an event location. Eventsassociated with a geo cell can be stored back into an entry for the geocell in the geo cell database. Thus, over time an historical progressionof events within a geo cell can be accumulated.

As such, event detection infrastructure 103 can assign an event ID, anevent time, an event location, an event category, an event description,an event truthfulness, and an event severity to each detected event.Detected events can be sent to relevant entities, including to mobiledevices, to computer systems, to APIs, to data storage, etc.

Event detection infrastructure 103 detects events from informationcontained in normalized signals 122. Event detection infrastructure 103can detect an event from a single normalized signal 122 or from multiplenormalized signals 122. In one aspect, event detection infrastructure103 detects an event based on information contained in one or morenormalized signals 122. In another aspect, event detectioninfrastructure 103 detects a possible event based on informationcontained in one or more normalized signals 122. Event detectioninfrastructure 103 then validates the potential event as an event basedon information contained in one or more other normalized signals 122.

As depicted, event detection infrastructure 103 includes geodetermination module 104, categorization module 106, truthfulnessdetermination module 107, and severity determination module 108.

Geo determination module 104 can include NLP modules, image analysismodules, etc. for identifying location information from a normalizedsignal. Geo determination module 104 can formulate (e.g., location)search terms 141 by using NLP modules to process audio, using imageanalysis modules to process images, etc. Search terms can include streetaddresses, building names, landmark names, location names, school names,image fingerprints, etc. Event detection infrastructure 103 can use aURL or identifier to access cached content when appropriate.

Categorization module 106 can categorize a detected event into one of aplurality of different categories (e.g., fire, police response, massshooting, traffic accident, natural disaster, storm, active shooter,concerts, protests, etc.) based on the content of normalized signalsused to detect and/or otherwise related to an event.

Truthfulness determination module 107 can determine the truthfulness ofa detected event based on one or more of: source, type, age, and contentof normalized signals used to detect and/or otherwise related to theevent. Some signal types may be inherently more reliable than othersignal types. For example, video from a live traffic camera feed may bemore reliable than text in a social media post. Some signal sources maybe inherently more reliable than others. For example, a social mediaaccount of a government agency may be more reliable than a social mediaaccount of an individual. The reliability of a signal can decay overtime.

Severity determination module 108 can determine the severity of adetected event based on or more of: location, content (e.g., dispatchcodes, keywords, etc.), and volume of normalized signals used to detectand/or otherwise related to an event. Events at some locations may beinherently more severe than events at other locations. For example, anevent at a hospital is potentially more severe than the same event at anabandoned warehouse. Event category can also be considered whendetermining severity. For example, an event categorized as a “Shooting”may be inherently more severe than an event categorized as “PolicePresence” since a shooting implies that someone has been injured.

Geo cell database 111 includes a plurality of geo cell entries. Each geocell entry is included in a geo cell defining an area and correspondingsupplemental information about things included in the defined area. Thecorresponding supplemental information can include latitude/longitude,street names in the area defined by and/or beyond the geo cell,businesses in the area defined by the geo cell, other Areas of Interest(AOIs) (e.g., event venues, such as, arenas, stadiums, theaters, concerthalls, etc.) in the area defined by the geo cell, image fingerprintsderived from images captured in the area defined by the geo cell, andprior events that have occurred in the area defined by the geo cell. Forexample, geo cell entry 151 includes geo cell 152, lat/lon 153, streets154, businesses 155, AOIs 156, and prior events 157. Each event in priorevents 157 can include a location (e.g., a street address), a time(event occurrence time), an event category, an event truthfulness, anevent severity, and an event description. Similarly, geo cell entry 161includes geo cell 162, lat/lon 163, streets 164, businesses 165, AOIs166, and prior events 167. Each event in prior events 167 can include alocation (e.g., a street address), a time (event occurrence time), anevent category, an event truthfulness, an event severity, and an eventdescription.

Other geo cell entries can include the same or different (more or less)supplemental information, for example, depending on infrastructuredensity in an area. For example, a geo cell entry for an urban area cancontain more diverse supplemental information than a geo cell entry foran agricultural area (e.g., in an empty field).

Geo cell database 111 can store geo cell entries in a hierarchicalarrangement based on geo cell precision. As such, geo cell informationof more precise geo cells is included in the geo cell information forany less precise geo cells that include the more precise geo cell.

Geo determination module 104 can query geo cell database 111 with searchterms 141. Geo cell database 111 can identify any geo cells havingsupplemental information that matches search terms 141. For example, ifsearch terms 141 include a street address and a business name, geo celldatabase 111 can identify geo cells having the street name and businessname in the area defined by the geo cell. Geo cell database 111 canreturn any identified geo cells to geo determination module 104 in geocell subset 142.

Geo determination module can use geo cell subset 142 to determine thelocation of event 135 and/or a geo cell associated with event 135. Asdepicted, event 135 includes event ID 132, time 133, location 137,description 136, category 137, truthfulness 138, and severity 139.

Event detection infrastructure 103 can also determine that event 135occurred in an area defined by geo cell 162 (e.g., a geohash havingprecision of level 7 or level 9). For example, event detectioninfrastructure 103 can determine that location 134 is in the areadefined by geo cell 162. As such, event detection infrastructure 103 canstore event 135 in events 167 (i.e., historical events that haveoccurred in the area defined by geo cell 162).

Event detection infrastructure 103 can also send event 135 to eventnotification module 116. Event notification module 116 can notify one ormore entities about event 135.

Privacy Infrastructure

Referring now to FIG. 1C, privacy infrastructure 102 spans signalingestion modules 102, event detection infrastructure 103, and eventnotification 116. Privacy infrastructure 102 can implement any describeduser information privacy operations (e.g., removal, scrubbing,stripping, obfuscation, access rule application, etc.) within and/orthrough interoperation with one or more of ingestion modules 101, eventdetection infrastructure 103, and event notification 116.

As such, privacy infrastructure 102 may be configured to apply privacyrules, including data scrubbing, during the process of signal ingestion,event detection, and/or event notification. For example, whilenormalizing one of raw signals 121, privacy infrastructure 102 may beused to alter an aspect of the raw signal 121 relating to the Timedimension. One way this may be done is to round a time-stamp to thenearest second, minute, hour, etc. By reducing precision associated witha timestamp, privacy can be increased (e.g., by making it impossible todirectly link a signal aspect to the original aspect). However, thereduced time-stamp precision may cause little, if any, correspondingreduction in identifying an event based on the raw signal 121. Dependingon signal type, the level of precision may be more or less important toevent detection and may also be more or less helpful in eliminating userinformation. Thus, heuristics may be applied to different signal typesto determine relevancy of precision and/or relevancy of reducing userinformation footprint.

Privacy infrastructure 102 can also modify location informationassociated with a signal in a manner that irreversibly increases privacywith little, if any, reduction in event detection capabilities. Forexample, privacy infrastructure 102 can reduce or eliminate GPSprecision. Depending on the signal type, location information may notbenefit event detection. In such cases, signal specific rules may beimplemented to reduce or eliminate the unnecessary information prior toevent detection processing.

Privacy infrastructure 102 can also modify different types of contextualinformation to improve privacy. For example, vehicle telematicsinformation may include metadata identifying a make/model of a vehicle.However, if such telematic information is used to detect events, suchas, car accidents, the exact make/model of the automobile may not benecessary and can be eliminated from the signal during normalization. Inanother example, content from a social media post may be scrubbed toeliminate extraneous information. This may be accomplished throughnatural language processing and configured to eliminate content such asnames, locations, or other sensitive information.

Privacy infrastructure 102 can implement/apply privacy operationsthrough interaction and/or interoperation with signal ingestion modules101 (e.g., prior to, during, or after signal ingestion). In one aspect,privacy infrastructure 102 performs privacy actions during signalingestion including applying a layer of obfuscation along with anindication of how and/or when any reversible linkage should bedestroyed, scrubbed, or otherwise removed from the system. For example,a user ID field may be hashed using a customized salt during signalingestion and marked with time-domain expiry information. The data thenproceeds through the system, for example, to event detection, in itssalted form. While within the time-domain, the customized salt may beavailable if it becomes necessary to ascertain the pre-obfuscated data.However, once the time-domain has expired, the custom salt may bedestroyed. Destroying the custom salt essentially permanently andirreversibly obscures the data element (at least to the degree providedby hash/encryption algorithm chosen for the obfuscation) fromtransformation back to its pre-salted form.

Privacy infrastructure 102 can also implement/apply privacy operationsthrough interaction and/or interoperation with event detectioninfrastructure 103 (e.g., prior to, during, or after event detection).Applying obfuscation during event detection may include applyingadditional techniques that are appropriate when different portions ofdata (possibly from different sources) are to be aggregated. In oneexample, when one data signal is determined to be related to an eventthat includes data from other data signals, permissions for eachrespective data signal may be determined. Based upon those permissions,one or more data elements from within one or more of the event relatedsignals may be hidden, scrubbed, or otherwise obfuscated.

For example, if an event is detected using a first signal from a firstentity and a second signal from a second entity, permissions may beconsulted to determine whether the first entity has permission to seeall of the data fields provided within the signal of the second entity.When the first entity does not have permission for one or more fields,those fields may be dropped or obscured. In some scenarios, this mayresult in a failed event detection, or an event detection with a lowerrelative reliability. Reducing reliability may be appropriate, or evendesired, to increase user privacy. In such scenarios, additional signalscan be used to corroborate the event detection without reference to userinformation contained in the first or second signals.

Generally, event detection without reference to user information maymake event detection less efficient and/or effective (e.g., more signalsare required, more processing time is required, etc.). However, thetrade-off between privacy and additional signal processing may beappropriate and is often desirable. Further, the ability to detectevents using privacy-aware methods increases data security.

Privacy infrastructure 102 can also implement/apply privacy operationsthrough interaction and/or interoperation with event notification 116(e.g., prior to, during, or after event notification). Once an event,such as event 135, has been identified, a notification may be generatedin a way that maintains user privacy. In one aspect, useridentifications may be removed from a notification altogether where thenotification can be determined to not need such identifiers. This may bedetermined based on the identity of the recipient and notifications ofthe same event customized based on the recipient. For example, if anevent is a fire, a police officer may receive a notification of the fireevent along with a description of a suspected arsonist. A fire fighter,on the other hand, may only receive notification of the occurrence ofthe fire. In this way, the use of personal information is limited inscope according to relevance to the recipient.

In another example, privacy infrastructure 102 and/or event notification116 may employ dynamic notifications that apply rules to userinformation that may change over time or according to context. Forexample, a user may access a dynamic notification during a designatedtime-window in which a suspect description is available. At a latertime, the user may access the same dynamic notification but be unable tosee the suspect descriptors. This change in access may be based on atime-domain (e.g., available for 24 hours) or a relevance domain (e.g.,removed if an updated description is received, a suspect is arrested,etc.)

A dynamic notification may also be implemented such that userinformation is always initially obscured but may be available uponrequest and authentication by a user. This process may rely onuser-based, role-based, or other dynamic or static heuristics. It isappreciated that any combination of these techniques may be implemented.

FIG. 2 illustrates a flow chart of an example method 200 for normalizingingested signals. Method 200 will be described with respect to thecomponents and data in computer architecture 100.

Method 200 includes ingesting a raw signal including a time stamp, anindication of a signal type, an indication of a signal source, andcontent (201). For example, signal ingestion modules 101 can ingest araw signal 121 from one of: social signals 171, web signals 172, orstreaming signals 173.

Method 200 includes forming a normalized signal from characteristics ofthe raw signal (202). For example, signal ingestion modules 101 can forma normalized signal 122A from the ingested raw signal 121.

Forming a normalized signal includes forwarding the raw signal toingestion modules matched to the signal type and/or the signal source(203). For example, if ingested raw signal 121 is from social signals171, raw signal 121 can be forwarded to social content ingestion modules174 and social signal processing modules 181. If ingested raw signal 121is from web signals 172, raw signal 121 can be forwarded to web contentingestion modules 175 and web signal processing modules 182. If ingestedraw signal 121 is from streaming signals 173, raw signal 121 can beforwarded to stream content ingestion modules 176 and streaming signalprocessing modules 183.

Forming a normalized signal includes determining a time dimensionassociated with the raw signal from the time stamp (204). For example,signal ingestion modules 101 can determine time 123A from a time stampin ingested raw signal 121.

Forming a normalized signal includes determining a location dimensionassociated with the raw signal from one or more of: location informationincluded in the raw signal or from location annotations inferred fromsignal characteristics (205). For example, signal ingestion modules 101can determine location 124A from location information included in rawsignal 121 or from location annotations derived from characteristics ofraw signal 121 (e.g., signal source, signal type, signal content).

Forming a normalized signal includes determining a context dimensionassociated with the raw signal from one or more of: context informationincluded in the raw signal or from context signal annotations inferredfrom signal characteristics (206). For example, signal ingestion modules101 can determine context 126A from context information included in rawsignal 121 or from context annotations derived from characteristics ofraw signal 121 (e.g., signal source, signal type, signal content).

Forming a normalized signal includes inserting the time dimension, thelocation dimension, and the context dimension in the normalized signal(207). For example, signal ingestion modules 101 can insert time 123A,location 124A, and context 126A in normalized signal 122. Method 200includes sending the normalized signal to an event detectioninfrastructure (208). For example, signal ingestion modules 101 can sendnormalized signal 122A to event detection infrastructure 103.

In some aspects, method 200 also includes one or more privacyoperations. Privacy infrastructure 102 can implement and/or apply anydescribed privacy operations, such as, user information removal, userinformation scrubbing, user information stripping, user informationobfuscation, access rule application, etc., prior to, during, or afterany of: 201, 202, 203, 204, 205, 206, 207, or 208.

Communication Channel/Streaming Data Source Event Detection System

A system for detecting events from communication channels can includeone or more communication channels and one or more analysis modules. Acommunication channel can carry one or more (e.g., streaming)communication signals, such as, streaming audio signals or other datastreams. Events can be detected from characteristics of communicationsignals or other data streams ingested from the one or morecommunication channels or from other streaming data sources.

In one aspect, each communication channel and/or data stream source canpre-associated with a geographic region or jurisdiction, such as, amunicipality, county, city block, district, city, state, or othergeographic region, but can alternatively be associated with a pluralityof geographic regions. The geographic region for a communication channelor data stream source can be received from a user, but can alternativelybe automatically learned (e.g., based on the locations extracted from acommunication signal) or otherwise determined. A communication channelor data stream source can be an audio chancel, a video channel, or anyother suitable channel. A communication channel can be a radio channel(e.g., a predetermined set of radio frequencies), optical channel (e.g.,a predetermined set of light frequencies), or any other suitablechannel. Examples of communication channels include: wireline andwireless telephone networks, computer networks broadcast and cabletelevision, radio, Public Safety Land Mobile Radio, satellite systems,the Internet, Public Safety Answer Points (PSAPs) networks, Voice overInternet Protocol (VoIP) networks, or any other suitable channel. Acommunication channel can be public or private (e.g., wherein the logininformation can be stored, tokenized, or otherwise processed).Communication channels can be emergency communications (e.g., police,medical, coast guard, snow rescue, fire rescue, etc.), fleetcommunications (e.g., for a ridesharing fleet, a trucking fleet, etc.),or any other suitable set of communications.

A communication signal or streaming data can encode content or otherinformation. A communication signal or streaming data can be an audiosignal, video signal, or any other suitable signal. A communicationsignal or streaming data can be digital (e.g., VOIP), analog, or haveany other suitable format. A communication signal or streaming data canbe associated with signal parameters (e.g., audio parameters), such asamplitude (e.g., volume), frequency, patterns, or any other suitableparameters. A communication signal or streaming data can be generated byan operator (e.g., dispatcher), in-field personnel (e.g., emergencypersonnel, firefighters, fleet operators, police, etc.), automaticallygenerated, or generated by any other suitable entity. The entities canbe associated with schedules (e.g., shifts), voice fingerprints,identifiers (e.g., names, codes, etc.), communication channels, modules(e.g., syntax modules), geographic regions (e.g., city blocks,municipalities, etc.), or any other suitable information. The entityinformation can be received (e.g., from a managing entity, such as amanager), automatically learned (e.g., historic patterns extracted fromhistoric communication signals for the communication channel), orotherwise determined.

The one or more analysis modules can analyze communication signals,streaming data, or subsets thereof (e.g., communication clips,communication sub-clips, etc.). For example, a first module can selectcommunication clips from the communication signal, a second module canidentify a sub-clip for event probability analysis, a third module candetermine the event probability from the sub-clip, a fourth module candetermine a clip score for the communication clip (e.g., based on thesub-clip, surrounding signals, signal parameters, etc.), a fifth modulecan extract event parameters from the communication clip, and a sixthmodule can determine an event score based on the extracted eventparameters. However, the system can include any suitable number ofmodules, arranged in any suitable configuration.

Similar arrangements of analysis modules can analyze streaming data. Afirst module can select streaming data sets from streaming data, asecond module can identify a data subset for event probability analysis,a third module can determine the event probability from the data subset,a fourth module can determine a data set score for the data set (e.g.,based on the data subset, surrounding signals, signal parameters, etc.),a fifth module can extract event parameters from the data set, and asixth module can determine an event score based on the extracted eventparameters. However, the system can include any suitable number ofmodules, arranged in any suitable configuration.

The analysis modules can be included in, integrated with, and/orinteroperate with signal ingestion modules 101 (e.g., stream contentingestion modules 176 and stream processing modules 183) and/or eventdetection infrastructure 103.

Analysis modules can be specific to a communication channel, a streamingdata source, a subset of communication channels, or subset of streamingdata sources (e.g., sharing a common parameter, such as location, state,time, etc.), an analysis stage, a set of analysis stages, be global, orbe otherwise related to analysis processes and/or communication channelsor streaming data sources. For example, a clip determination module canbe used for communication signals from any communication channel (e.g.,wherein the signals can be fed into the same clip determination module,or the same clip determination module is replicated for eachcommunication channel) with channel-specific modules used for remainingprocesses. However, analysis modules can be shared across communicationchannels and/or streaming data sources for any suitable process.Analysis modules can be constant over time (e.g., used in multiplecontexts), or can be dynamically selected based on time of day, eventtype (e.g., selected based on the event identifier extracted from acommunication clip or other steaming data), the entities generating thecommunication signal or other streaming data, or based on any othersuitable contextual parameter.

One or analysis more modules with the same communication channel and/orstreaming data source and/or analysis process can operate concurrently.For example, multiple analysis modules can be concurrently executed tominimize module overfitting, and/or to concurrently test multipleversions of the same module (e.g., wherein the best module, such as themodule that generates the least number of false positives or negatives,is subsequently selected for general use or subsequent training). Themultiple modules can process the same clips, different clips, samesteaming data, different streaming data, any suitable set of clips, orany suitable set of streaming data. In another example, multiple modulesare serially tested (e.g., on serial clips, on serial streaming data,the same clips, the same streaming data, etc.). However, any suitablenumber of module variants can be used.

Each analysis module can implement any one or more of: a rule-basedsystem (e.g., heuristic system), fuzzy logic (e.g., fuzzy matching),regression systems (e.g., ordinary least squares, logistic regression,stepwise regression, multivariate adaptive regression splines, locallyestimated scatterplot smoothing, etc.), genetic programs, supportvectors, an instance-based method (e.g., k-nearest neighbor, learningvector quantization, self-organizing map, etc.), a regularization method(e.g., ridge regression, least absolute shrinkage and selectionoperator, elastic net, etc.), a decision tree learning method (e.g.,classification and regression tree, iterative dichotomiser 3, C4.5,chi-squared automatic interaction detection, decision stump, randomforest, multivariate adaptive regression splines, gradient boostingmachines, etc.), a Bayesian method (e.g., naïve Bayes, averagedone-dependence estimators, Bayesian belief network, etc.), a kernelmethod (e.g., a support vector machine, a radial basis function, alinear discriminate analysis, etc.), a clustering method (e.g., k-meansclustering, expectation maximization, etc.), an associated rule learningalgorithm (e.g., an Apriori algorithm, an Eclat algorithm, etc.), anartificial neural network model (e.g., a Perceptron method, aback-propagation method, a Hopfield network method, a self-organizingmap method, a learning vector quantization method, etc.), a deeplearning algorithm (e.g., a restricted Boltzmann machine, a deep beliefnetwork method, a convolution network method, a stacked auto-encodermethod, etc.), a dimensionality reduction method (e.g., principalcomponent analysis, partial lest squares regression, Sammon mapping,multidimensional scaling, projection pursuit, etc.), an ensemble method(e.g., boosting, bootstrapped aggregation, AdaBoost, stackedgeneralization, gradient boosting machine method, random forest method,etc.), and/or any suitable form of machine learning algorithm. Eachmodule can additionally or alternatively include: probabilisticproperties, heuristic properties, deterministic properties, and/or anyother suitable properties. However, analysis modules can leverage anysuitable computation method, machine learning method, and/or combinationthereof.

Each analysis module can be generated, trained, updated, or otherwiseadjusted using one or more of: manual generation (e.g., received from auser), supervised learning (e.g., using logistic regression, using backpropagation neural networks, using random forests, decision trees,etc.), unsupervised learning (e.g., using an Apriori algorithm, usingK-means clustering), semi-supervised learning, reinforcement learning(e.g., using a Q-learning algorithm, using temporal differencelearning), and any other suitable learning style.

Each analysis module can be validated, verified, reinforced, calibrated,or otherwise updated based on newly received, up-to-date signals;historic signals (e.g., labeled or unlabeled); or be updated based onany other suitable data. Each module can be run or updated: in responseto a number of false positives and/or false negatives exceeding athreshold value, determination of an actual result differing from anexpected result, or at any other suitable frequency.

Analysis modules may also be included in and/or interoperate withprivacy infrastructure 102. The analysis modules can be configured toimplement and/or apply any described privacy operations concurrentlywith other described operations.

Detecting Events from Communication Signals

Aspects of the invention include using the described system to detectevents from (e.g., streaming) communication signals, including streamingaudio signals. Events can be detected concurrently as new communicationsignals are received, at a predetermined frequency, sporadically, inresponse to a trigger condition being met, or at any other suitabletime.

FIG. 3 illustrates a flow chart of an example method 300 for ingesting acommunication stream and detecting an event. Method 300 includesreceiving a communication stream (301). For example, a communicationstream can be received from an audio channel, a video channel, or anyother suitable channel. The communication stream can be received by aremote computing system (e.g., server system), a user device or anyother suitable device. The communication stream can be generated by anentity, automatically generated (e.g., by a burglar alarm system), or beotherwise generated. A plurality of communication streams can bereceived concurrently from one or more communication channels or can bereceived at different times (e.g., in response to occurrence of areceipt condition being met, such as the signal amplitude exceeding athreshold value for a threshold period of time, etc.).

Method 300 includes selecting a communication clip from thecommunication stream (302). For example, a communication clip can be anaudio clip, a video clip, or any other suitable clip. A communicationclip can be a time-bounded segment of the received communication stream(e.g., substantially continuous segment, etc.), but can be otherwisedefined. The communication clip can encompass a statement by a singleentity, a conversation between two or more entities, or include anyother suitable set of communications. One or more communication clipscan be identified from a communication stream. The communication clipcan be associated with a beginning timestamp, an end timestamp, aduration, one or more entities (e.g., generating the content in theclip), location (e.g., geographic region associated with thecommunication channel, geographic sub-region identified from thecommunication content, etc.), event, and/or any other suitableparameter.

As such, identifying the communication clip can include determining aclip beginning timestamp, determining a clip end timestamp, and storinga communication segment between the beginning and end timestamps. Thebeginning and end timestamps can be determined by a beginning module andend module, respectively. The beginning and end modules can be sharedacross a plurality of communication channels (e.g., be global modules)or can be specific to a given communication channel. The communicationstream can be pre-processed to remove noise or other undesired acousticfeatures prior to communication clip identification, or can be the rawcommunication stream, a compressed communication stream, a normalizedcommunication stream, or any other suitable version of the communicationstream.

Determining a clip beginning timestamp can include detecting a beginningcondition in the communication stream (e.g., received from a user,triggered by a sensor measurement, etc.). The beginning condition caninclude: the signal amplitude exceeding a threshold amplitude for athreshold period of time (e.g., a sustained increased volume on thechannel; wherein the signal can be cached for at least the thresholdperiod of time to enable beginning condition detection), the signalamplitude change exceeding a threshold change (e.g., a sudden increasein volume on the channel), the signal frequency patterns substantiallymatching a predetermined pattern (e.g., a characteristic beep or keywordprecedes every transmission, wherein the pattern is associated with thebeep or keyword), or be any other suitable condition.

Determining a clip end timestamp can include detecting an endingcondition in the communication stream (e.g., received from a user,triggered by a sensor measurement, etc.). The ending condition caninclude: a satisfaction of a time condition after the beginningcondition was detected (e.g., 30 seconds after the beginning condition,1 minute after the beginning condition, etc.); the signal amplitude ordifference falling below a threshold amplitude for a threshold period oftime (e.g., wherein the last speech timestamp before the delay is set asthe end timestamp); the signal frequency patterns substantially matchinga predetermined pattern (e.g., a characteristic beep or keyword marksthe end of every transmission, wherein the pattern is associated withthe beep or keyword), or be any other suitable condition.

Identifying the communication clip can include stitching multiple audioclips together into a conversation (e.g., between dispatcher andemergency personnel). Stitching can be performed after a highly scoredclip is detected, after a beginning condition is detected, or at anysuitable time. In one variation, stitching includes: identifying a firstvoice and keyword within a first communication clip, identifying asecond voice and the same or related keyword within a secondcommunication clip, identifying subsequent audio clips including thefirst and second voices until a conversation end condition is met (e.g.,end keyword is detected, the first or second voice has not been detectedfor a threshold period of time, etc.), and stitching the identifiedclips together into a conversation clip, wherein the conversation clipcan be subsequently analyzed as the communication clip. However, theconversation can be otherwise aggregated.

Storing a communication segment between a beginning and end timestampscan include caching the communication stream after the beginningtimestamp (e.g., timestamp of the stream segment from which thebeginning condition was detected) until the end timestamp is determined(e.g., until the end condition is met), wherein segments of thecommunication stream outside of the beginning and end timestamps are notstored and/or deleted immediately. Alternatively, storing thecommunication segment can include storing the entire communicationstream, post-processing the communication stream to extractcommunication segments, and optionally deleting the source communicationstream. However, the communication segment can be otherwise stored.

Method 300 includes determining a clip score for the communication clip(303). For example, a clip score can be computed for a stored (cached)communication segment. Based on a clip score, it can be determined iffurther processing is worthwhile (e.g., how likely a clip is to includeevent information). Thus, a clip score can be indicative of whether acommunication clip includes event information, more preferably whetherthe communication clip includes information for an event of interest,but can be associated with any other suitable parameter. An event ofinterest can be an event that occurs with less than a thresholdfrequency within a geographic region, be an event having aclassification or type falling within a predetermined list (e.g.,automatically generated, received from a managing entity, etc.), be anevent with an event score exceeding a threshold score, or be otherwisedefined.

A clip score can be: a score, a classification, a probability, afitness, or be any other suitable metric. The clip score can bedetermined by a clip score module, such as a heuristic, probabilistic,or Bayesian module, a neural network, a genetic program, or othersuitable module leveraging any other suitable analysis process. A clipscore module can be specific to a communication channel (and/or entitygenerating the communication signal, such as a dispatcher) or can beglobal.

In one aspect, determining a clip score includes (a) identifying asub-clip within the communication clip with the highest probability ofhaving an event identifier, (b) analyzing the sub-clip for an eventidentifier, and (c) determining the clip score based on eventidentifier. The event identifier can be a keyword (e.g., “fire,” “shot,”other descriptor, etc.), a code (e.g., “211” for robbery, “242” forbattery, “187” for homicide, etc.), or be any other suitable identifier.

A sub-clip can be identified by a module specific to a communicationchannel or geographic region associated with the communication channel.A sub-clip can be identified (e.g., extracted) based on a predeterminedsyntax or pattern associated with the communication channel orgeographic region randomly selected, determined by pattern-matching thesignal parameters (e.g., amplitude patterns, frequency patterns, etc.),or otherwise identified. A predetermined syntax can include an eventidentifier position within the communication clip and can include otherinformation arranged in a predetermined pattern or order.

For example, a predetermined syntax can include an event identifier,followed by an event severity, followed by an event location. In anotherexample, a predetermined syntax can include an entity identifier, anevent identifier, and an event description. In a further example, apredetermined syntax can include an event identifier's start and endtimestamp within the communication clip (e.g., between 0 sec and 30 sec,between 10 sec and 30 sec into the clip). A predetermined syntax can bereceived from an entity associated with the communication channel orgeographic region, learned (e.g., from historic communication clips fromthe communication channel), or otherwise determined.

FIG. 6A depicts an example channel syntax 601 including an eventidentifier, followed by a recipient ID, followed by an event location,followed by event details. FIG. 6B depicts an example channel syntax 602including an event identifier, followed by another event identifier,followed by a recipient ID, followed by an event location. In someaspects, it may be that a portion of syntax/channel 601 and/orsyntax/channel 602 includes user information.

Analyzing a sub-clip for an event identifier can determine whether theclip includes an event identifier and/or which event identifier the clipincludes. In a first variation, analyzing a sub-clip includes:performing natural language processing on the sub-clip to extract theevent identifier. In a second variation, analyzing the sub-clipincludes: identifying the author of the sub-clip (e.g., the speaker),retrieving signal patterns associated with the author, identifying asignal pattern (from the retrieved signal patterns) substantiallymatching the sub-clip, and associating the sub-clip with the eventidentifier associated with the identified signal pattern. The author ofthe sub-clip can be identified using: voice recognition, based on thetime (e.g., according to a shift schedule), an entity code or nameextracted from the communication clip, or otherwise determined.

Determining the clip score based on event identifier can indicatewhether a communication clip is to be subsequently (further) processedto extract event parameters. In one variation, a clip is assigned a clipscore associated with the event identifier (e.g., extracted from thesub-clip). In a second variation, a clip score is calculated from theevent identifier, signal parameters (e.g., amplitude, frequency, etc.),keywords surrounding the sub-clip, and/or any other suitable parametervalue.

In a second variation, a clip score is determined from feature valuesextracted from the communication clip. In one aspect, clips scoredetermination includes: extracting keywords from the communication clip(e.g., event identifiers, etc.) and calculating the clip score based onvalues, weights, and/or other metrics associated with the extractedkeywords. In a second aspect, clips score determination includes:identifying a location from the communication clip, identifying socialnetworking system content authored within a predetermined time window ofthe communication clip timestamp, and calculating the clip score basedon features extracted from the content.

In a third variation, a clip score is determined based on the signalparameter values. For example, a clip score can be calculated from thesignal amplitude (e.g., mean, median, duration above a threshold value,etc.), the amplitude change, the frequency (e.g., mean, median,deviation, duration above a threshold value, etc.), the signal parametervalue deviation from a baseline value for the geographic location, orfrom any other suitable signal parameter value or metric. In a fourthvariation, a clip score is determined based on a signal pattern, whereineach of a predetermined set of signal patterns is associated with a clipscore (e.g., determined from past verified events).

Method 300 includes extracting event parameters from the communicationclip (304). Event parameters can include the event location, event time(e.g., start time, end time, duration), subject matter or context (e.g.,fire, shooting, homicide, cat in tree, etc.), severity (e.g., 3 alarmfire, 2 alarm fire, gunfire v. murder), people, or any other suitableevent parameter. Event parameters can be extracted from thecommunication clip in response to clip score exceeding threshold clipscore or upon satisfaction of any other suitable condition. The eventparameters can be extracted from the entirety of a communication clip,from sub-clips of the communication clip (e.g., the same or differentsub-clip from that used to determine the event identifier), fromauxiliary (other) signals identified based on the communication clipparameters (e.g., geographic region, time, volume of interactionsbetween emergency personnel and operator, signal strength, signalparameters, etc.), channel parameters (e.g., geographic region, historicfrequency of events detected from the channel), clip content (e.g.,words, phrases, cadence, number of back-and-forth communications, etc.),or from any other suitable information. Event parameters can beextracted using modules specific to a communication channel (e.g.,trained on historic labeled signals from the communication channel), orusing global modules. Each event parameter can be extracted using adifferent module (e.g., one for event location, another for event time),but can alternatively be extracted using the same module or any othersuitable set of modules.

In one variation, extracting event parameters includes determining theevent location. The event location can be a geofence, specific location(e.g., latitude, longitude, etc.), address, specific location obfuscatedto a predetermined radius, a geographic region identifier (e.g.,municipality identifier, district identifier, city identifier, stateidentifier, etc.), or be any other suitable location identifier. Theevent location can be determined from the geographic region associatedwith the source communication channel, location identifiers extractedfrom the communication clip, the location of the in-field recipient(e.g., retrieved from the recipient's user device location, therecipient's social networking system posts, etc.), or determined fromany other suitable information.

In one aspect, determining event location can include: identifying theinitial geographic region associated with the source communicationchannel, extracting a geographic identifier (e.g., street names, addressnumbers, landmark names, etc.) from the clip, finding a known geographicidentifier within the initial geographic region substantially matchingthe extracted geographic identifier (e.g., best match), and assigningthe known geographic identifier as the event location. In anotheraspect, determining an event location includes: extracting thegeographic identifier from the clip and searching a global set of knownidentifiers for a match. Extracting the geographic identifier caninclude: analyzing the entire communication clip for a geographicidentifier (e.g., performing NLP on the entire clip); identifying asub-clip with the highest probability of having the geographicidentifier (e.g., using the syntax model, trained on historic audioclips with the geographic identifier portion tagged); identifying asignal pattern associated with a geographic identifier and performingNLP on the clip segment exhibiting the signal pattern; or otherwiseextracting the geographic identifier.

In a second variation, extracting event parameters includes determiningthe event time. In a first example, event time can be the communicationclip time. In second example, event time can be a time mentioned in thecommunication clip (e.g., specific time, relative time, such as “5minutes ago”). The time can be extracted from a sub-clip with thehighest probability of having the event time, or otherwise determined.

In a third variation, extracting event parameters includes determiningthe event subject matter or context. The subject matter or context canbe determined from the event identifier or from the content surroundingthe event identifier sub-clip (e.g., using NLP, pattern matching, etc.).

Extracted event parameters can be used to compute time dimension,location dimension, and context dimension for a (e.g., streaming)communication signal, such as, a streaming audio signal.

In a fourth variation, extracting event parameters includes determiningan event severity. The event severity can be determined from the eventidentifier (e.g., the event code, the keyword, etc.), the voiceregister, the voice amplitude, the word frequency, the keywordfrequency, the word choice, or from any other suitable parameter. Theevent severity can be a severity score, a classification, or be anyother suitable descriptor. For example, the event severity can be higherwhen the voice register is higher than the historic register for theentity. However, the event severity can be otherwise determined.

Method 300 can include extracting event parameters from auxiliary(other) signals (308). For example, event parameters can be extractedfrom other signals received at signal ingestion modules 101. Othersignals can include social signals, web signals, public cameras, socialbroadcasts, etc.

Method 300 includes determining an event score based on event parameters(305). An event score can be determined using an eventidentifier-specific module, a channel-specific module, acontext-specific module, a global module, or using any other suitablemodule. An event score can be calculated, computed, selected, matched,classified, or otherwise determined. An event score can be determinedbased on: event parameters extracted from the communication clip, thehistoric event parameters for the event location (see FIG. 7), thehistoric event parameters for the neighboring geographic locations, theevent parameters extracted from substantially concurrent communicationsignal(s) for neighboring geographic locations, auxiliary signalsassociated with the event location (e.g., posts from social networkingsystems, video, etc.), the number of detected clips (or other signals)associated with the event and/or event location, or from any othersuitable information.

In one example, an event score is calculated as a function of thedeviation between the extracted event parameter values and the historicevent parameter values. In a second example, an event score iscalculated from signal parameter values and an event identifier, whereinthe event identifier is associated with a value and the signalparameters are associated with differing weights.

FIG. 7 is an example of event scoring based on historic parameter valuesfor a geographic region. As depicted, (e.g., streaming) communicationsignals are received via channels 702A and 702B within geographic region701. For each channel 702A and 702B, a frequency per event class isdepicted. For event IDs 703A and 703D indicating “homicide”, lower eventscore 704A and higher event score 704B can be computed.

In one aspect, an event score is computed from parameters extracted froma (e.g., streaming) communication clip in combination with parametersextracted from auxiliary (other ingested) signals.

Method 300 includes detecting an event based on the event score (306).An event can be detected in response to an event score exceeding athreshold event score or upon satisfaction of any other suitablecondition. A threshold event score can specific to an entity (e.g.,financial entity, logistics entity, news entity, brand entity,protection services, etc.), can be global or can have any other suitablerelevancy. A threshold event score can be automatically determined forgeographic region (e.g., based on historic event scores for similarcontexts, such as time; historic clip scores for neighbors; etc.),received from the entity, automatically selected based on entityparameters (e.g., the entity's classification, profile, type, interests,keywords, event interests, etc.), or otherwise determined.

An event can optionally be validated using auxiliary (other ingested)signals. For example, a low-scoring event can be considered an event ofinterest in response to the same event being detected in multipleauxiliary (other) signal sources (e.g., social networking systems,multiple emergency services, Web signals, etc.). Alternatively, theevent score can be augmented or otherwise adjusted based on event scoresextracted from the auxiliary (other ingested) signals.

Method 300 includes acting based on the detected event (307). Forexample, an action can be performed in response to event detection. In afirst variation, a notification is sent to an entity in response toevent detection. The notification can include event parameters (e.g.,extracted from the communication clip, from auxiliary signals, etc.) orany other suitable information. In a second variation, delivery systems,vehicles, or other systems are automatically rerouted based on an eventlocation, event type (e.g., extracted from the event identifier), eventseverity, and/or event time (e.g., to avoid the event). In a thirdvariation, content (e.g., posts, images, videos, sensor signals, orother content) associated with the event location and generated proximalthe event time from the communication channel, auxiliary (other)signals, or other sources is aggregated.

In some aspects, method 300 also includes one or more privacyoperations. Privacy infrastructure 102 can implement and/or apply anydescribed privacy operations, such as, user information removal, userinformation scrubbing, user information stripping, user informationobfuscation, access rule application, etc., prior to, during, or afterany of: 301, 302, 303, 304, 305, 306, 307, or 308.

Event Score Generation Example

FIG. 4 illustrates an example computer architecture 400 that facilitatesgenerating an event score from ingested communication streams. Asdepicted, computer architecture 400 includes clip selector 401, clipscore calculator 402, parameter extractor 404, event score calculator406, and resource allocator 407. Clip score calculator 402 furtherincludes sub-clip identifier 403. Clip selector 401, clip scorecalculator 402, parameter extractor 404, event score calculator 406, andresource allocator 407 can be included in, integrated with, and/orinteroperate with signal ingestion modules 101 (e.g., stream contentingestion modules 176 and stream processing modules 183) and/or eventdetection infrastructure 103.

In general, clip selector 401 is configured select a clip from a (e.g.,streaming) communication (e.g., audio) signal using any of the describedclip selection mechanisms. Clip score calculator 402 is configured tocalculate a clip score for a selected clip using any of the describedmechanisms. Sub-clip identifier 403 is configured to identify a sub-clipfrom within a selected clip using any of the described mechanisms.Parameter extractor 404 is configured to extract parameters from aselected clip using any of the described mechanisms. Event scorecalculator is configured to calculate an event score from extractedparameters using any of the described mechanisms.

Resource allocator 407 is configured to determine when additionalresources are to be allocated to further process a selected clip. Whenadditional resources are to be allocated, resource allocator allocatesthe additional resources to parameter extractor 404 and event scorecalculator. In one aspect, resource allocator determines when additionalresources are to be allocated based on a clip score. When a clip scoreexceeds a threshold clip score, additional resources can be allocated.When a clip score does not exceed a threshold clip score, additionalresources are not allocated. As such, additional resources can beallocated when there is increased likelihood of a (e.g., streaming)communication signal including event information. Otherwise, resourcesare conserved to allocate for other functions.

As depicted in FIG. 4, privacy infrastructure 102 can span modules thatfacilitate event score calculation, including clip selector 401, clipscore calculator 402 (including sub-clip identifier 403), parameterextractor 404, event score calculator 406, and resource allocator 407.Privacy infrastructure 102 can implement and/or apply any describedprivacy operations, such as, user information removal, user informationscrubbing, user information stripping, user information obfuscation,access rule application, etc., at and/or through interoperation with anyof: clip selector 401, clip score calculator 402 (including sub-clipidentifier 403), parameter extractor 404, event score calculator 406,and resource allocator 407.

FIG. 5 illustrates a flow chart of an example method 500 for generatingan event score from an ingested communication stream. Method 500 will bedescribed with respect to the components and data depicted in computerarchitecture 400.

Method 500 includes ingesting a communication stream (501). For example,clip selector 401 can ingest communication signal 421 (e.g., a streamingaudio signal) from audio signals 173A. Method 500 includes selecting acommunication clip from within the communication stream (502). Forexample, clip selector 401 can select clip 422 from communication signal421.

Method 500 includes computing a clip score from characteristics of thecommunication clip that indicates a likelihood of the communicationstream including event information (503). For example, clip scorecalculator 402 can compute clip score 426 from characteristics of clip422. Clip score 422 indicates a likelihood of communication signal 421including event information. In one aspect, sub-clip identifier 403identifies a sub-clip within the clip 422 with the highest probabilityof having an event identifier. Clip score calculator 402 analyzes thesub-clip for an event identifier and computes clip score 426 based onthe event identifier.

Method 500 includes determining further processing of the communicationclip is warranted based on the clip score (504). For example, resourceallocator 407 can determine that further processing of communicationsignal 422 is warranted based on clip score 426 (e.g., exceeding athreshold clip score). Method 500 includes allocating computingresources to further process the communication clip (505). For example,resource allocator 407 can allocate computing resources (e.g., memoryresources, processing resources, etc.) to parameter extractor 404 andevent score calculator 406

Method 500 includes extracting event parameters from the communicationclip utilizing the allocated computing resources (506). For example,parameter extractor 404 extracts parameters 423 from clip 422 utilizingcomputing resources 427. Method 500 includes computing an event scorefrom the extracted event parameters (507). For example, event scorecalculator 406 can calculate event score 424 from parameters 423(utilizing computing resources 427). Event score calculator can be sentto other modules of event detection infrastructure 103.

Method 500 includes detecting an event based on the event score (508).For example, event detection infrastructure 103 can detect an eventbased on events score 424. Entities can be notified of the detectedevent. The detected event can also provide a basis for reroutingdelivery vehicles or performing other actions.

In some aspects, method 500 also includes one or more privacyoperations. Privacy infrastructure 102 can implement and/or apply anydescribed privacy operations, such as, user information removal, userinformation scrubbing, user information stripping, user informationobfuscation, access rule application, etc., prior to, during, or afterany of: 501, 502, 503, 504, 505, 506, 507, or 508.

Concurrent Handling of Signals

FIG. 8 a computer architecture 800 that facilitates concurrentlyhandling communication signals (or other signals) from a plurality ofchannels. As depicted, computer architecture 800 includes clipextraction module 851, syntax modules 852A, 852B, and 852C, eventidentifier modules 853A, 853B, and 853C, event parameter modules 854A,854B, and 854C, event scoring module 856, event detection module 857,and device 813. Clip extraction module 851, syntax modules 852A, 852B,and 852C, event identifier modules 853A, 853B, and 853C, event parametermodules 854A, 854B, and 854C, event scoring module 856, event detectionmodule 857, and device 813 can be included in, integrated with, and/orinteroperate with signal ingestion modules 101 (e.g., stream contentingestion modules 176 and stream processing modules 183) and/or eventdetection infrastructure 103.

Clip extraction module 851 can receive streams 802A, 802B, and 802C fromchannels 801A, 801B, and 801C respectively. Streams 802A, 802B, and 802Ccan be included in streaming signals 173. Clip extraction module 851 canextract clips 804A, 804B, and 804C from streams 802A, 802B, and 802Crespectively. Syntax modules 852A, 852B, and 852C identify sub-clips806A, 806B, and 806C from clips 804A, 804B, and 804C respectively.

Sub-clips 806A, 806B, and 806C are locations in clips 804A, 804B, and804C respectively that are more likely to include event identifiers.Syntax modules 852A, 852B, and 852C can identify sub-clips 806A, 806B,and 806C based on syntax (e.g., 601, 602, etc.) of the geographiclocation, jurisdiction, corporation, etc. associated with each ofchannels 801A, 801B, and 801C respectively. Event identifier modules853A, 853B, and 853C attempt to identify event identifiers in sub-clips804A, 804B, and 804C respectively. As depicted, event identifier module853A identifies event identifier 807A and event identifier module 853Bidentifies event identifier 807B,

Event identifier module 853C does not identify an event identifier insub-clip 806. As such, it is unlikely that clip 804C contains eventinformation. Accordingly, no further computing resources are allocatedto process clip 804C.

Further resources can be allocated to event parameter modules 854A and854B. Event parameter module 854A can extract event parameters 803A fromclip 804A using the allocated resources. Similarly, parameter module854B can extract event parameters 803B from clip 804B using theallocated resources. Event scoring module 856 can compute event score809A from event parameters 803A. Similarly, event scoring module 856 cancompute event score 809B from event parameters 803B.

Event detection module 857 can determine that event score 809B is to lowand does not indicate an event (e.g., event score 809B is below an eventscore threshold). On the other hand, event detection module 857 candetect event 811 based on event score 809A (e.g., event score 809A canexceed the event score threshold). Event detection module 857 can notify812 device 813 of the occurrence of event 811. Other action can also betaken in response to detecting event 811.

As depicted in FIG. 8, privacy infrastructure 102 can span modules thatfacilitate concurrent handling of communication signals, including clipextraction module 851, syntax modules 852A, 852B, and 852C, eventidentifier modules 853A, 853B, and 853C, event parameter modules 854A,854B, and 854C, event scoring module 856, and event detection module857. Privacy infrastructure 102 can implement and/or apply any describedprivacy operations, such as, user information removal, user informationscrubbing, user information stripping, user information obfuscation,access rule application, etc., at and/or through interoperation with anyof: clip extraction module 851, syntax modules 852A, 852B, and 852C,event identifier modules 853A, 853B, and 853C, event parameter modules854A, 854B, and 854C, event scoring module 856, and event detectionmodule 857.

Event Score Generation Additional Example

FIG. 9 illustrates an example computer architecture 900 that facilitatesdetecting an event from scores generated from ingested signals. Asdepicted, computer architecture 900 includes portion selector 901, scorecalculator 902, parameter extractor 904, event score calculator 906, andresource allocator 907. Portion selector 901, score calculator 902,parameter extractor 904, event score calculator 906, and resourceallocator 907 can be included in, integrated with, and/or interoperatewith signal ingestion modules 101 and/or event detection infrastructure103.

In general, portion selector 901 is configured select a portion of asignal from within the signal. The signal can be of virtually any signaltype, including signal types ingestible by signal ingestion modules 101or otherwise described. Portion score calculator 902 is configured tocalculate a portion score for a selected portion using any of thedescribed mechanisms.

Parameter extractor 904 is configured to extract parameters from anothersignal using any of the described mechanisms. The other signal can be ofvirtually any signal type, including signal types ingestible by signalingestion modules 101 or otherwise described. Event score calculator 906is configured to calculate an event score from extracted parametersusing any of the described mechanisms.

The signal and the other signal can be associated with, relevant to, oreven related to one another by one or more of: a Time dimension, aLocation dimension, or a Context dimension.

Resource allocator 907 is configured to determine when additional (e.g.,processor, memory, storage, etc.) resources are to be allocated toprocess the other signal. When additional resources are to be allocated,resource allocator allocates the additional resources to parameterextractor 904 and event score calculator 906. In one aspect, resourceallocator 907 determines when additional resources are to be allocatedbased on a portion score. When a portion score exceeds a thresholdportion score, additional resources can be allocated. When a portionscore does not exceed a threshold portion score, additional resourcesare not allocated. As such, additional resources can be allocated whenthere is increased likelihood of a signal including event information.Otherwise, resources are conserved to allocate for other functions.

As depicted in FIG. 9, privacy infrastructure 102 can span modules thatfacilitate event score calculation, including portion selector 901,score calculator 902 parameter extractor 904, event score calculator906, and resource allocator 907. Privacy infrastructure 102 canimplement and/or apply any described privacy operations, such as, userinformation removal, user information scrubbing, user informationstripping, user information obfuscation, access rule application, etc.,at and/or through interoperation with any of: portion selector 901,score calculator 902 parameter extractor 904, event score calculator906, and resource allocator 907.

FIG. 10 illustrates a flow chart of an example method 1000 for detectingan event from scores generated from ingested signals. Method 1000 willbe described with respect to the components and data depicted incomputer architecture 900.

Method 1000 includes ingesting a signal (1001). For example, portionselector 901 can ingest communication signal 921 (e.g., a streamingsignal, a non-streaming signal, a Web signal, a social signal, adatabase signal, etc.) from raw signals 173. Method 1000 includesselecting a portion of the signal from within the signal (1002). Forexample, portion selector 901 can select signal portion 922 from withinsignal 921.

Method 10000 includes computing a first score from the selected portion(or characteristics thereof) and indicating a likelihood of the signalincluding information related to an event type (1003). For example,score calculator 902 can compute portion 926 from characteristics ofsignal portion 922. Portion score 922 indicates a likelihood of signal921 including event information. In one aspect, portion selector 901identifies a portion of signal 921 with the highest probability ofhaving an event identifier. Score calculator 902 analyzes portion for anevent identifier and computes portion score 926 based on the eventidentifier.

Method 1000 includes determining further processing of another signal iswarranted based on the indicated likelihood (1004). For example,resource allocator 907 can determine that processing of signal 931 iswarranted based on a likelihood indicated by portion score 926. Method1000 includes allocating computing resources to further process thecommunication clip (1005). For example, resource allocator 907 canallocate computing resources 927 (e.g., memory resources, processingresources, etc.) to parameter extractor 904 and event score calculator906.

Method 1000 includes ingesting the other signal (1006). For example,parameter extractor 904 can ingest signal 931 (e.g., a streaming signal,a non-streaming signal, a Web signal, a social signal, a databasesignal, etc.) from raw signals 173. Method 1000 includes accessingparameters associated with the other signal (1007). For example,parameter extractor 904 can access parameters 932 associated with (andpossibly from) signal 931 (or characteristics thereof). Parameterextractor 901 can access parameters 932 utilizing allocated computingresources 927.

Method 1000 includes computing a second score from the parametersutilizing the allocated computing resources (1008). For example, eventscore calculator 906 can calculate event score 934 from parameters 932(utilizing computing resources 427). Event score calculator 906 can sendevent score calculator 906 to other modules of event detectioninfrastructure 103.

Method 1000 includes detecting a previously unidentified event of theevent type utilizing the allocated resources and based on the secondscore (1009). For example, event detection infrastructure 103 can detectan event based on event score 934 (and utilizing computing resources927). Entities can be notified of the detected event. The detected eventcan also provide a basis for rerouting delivery vehicles or performingother actions.

In some aspects, method 1000 also includes one or more privacyoperations. Privacy infrastructure 102 can implement and/or apply anydescribed privacy operations, such as, user information removal, userinformation scrubbing, user information stripping, user informationobfuscation, access rule application, etc., prior to, during, or afterany of: 1001, 1002, 1003, 1004, 1005, 1006, 1007, 1008, or 1009.

In one aspect, an ingested signal and/or detected event relates toavailability of beds in public and/or private care/treatment facilities.For example, a database signal can be ingested and used in detecting anavailable bed at a care/treatment facility. A database signal (orportion thereof or associated parameters) can be used in computation ofa first score or a second score.

In another aspect, an ingested signal and/or detected event relates topandemic ground truth. Streaming data sources can include (potentiallylive) health care data sources. Streaming health care data from healthcare data sources can be ingested in accordance with the Privacy Rule'sSafe Harbor provision, 45 C.F.R. § 164.514(b), including (1) when andwhere pandemic (e.g., COVID-19) symptoms are occurring, (2) a live heatmap of tests given and positive (e.g., COVID-19) diagnosis related to apandemic, (3) Emergency Department (ED) waiting times, and (4) availabletest kits, ventilators and bed capacity for both the ED and admissions.Privacy infrastructure 102 can implement and/or apply any describedprivacy operations to remove (or otherwise obscure) user informationincluded in streaming health care data.

As such, a unified interface can handle incoming signals and content ofany kind. The interface can handle live extraction of signals acrossdimensions of time, location, and context. In some aspects, heuristicprocesses are used to determine one or more dimensions. Acquired signalscan include text and images as well as live-feed binaries, includinglive media in audio, speech, fast still frames, video streams, etc.

Signal normalization enables the world's live signals to be collected atscale and analyzed for detection and validation of live events happeningglobally, all while protecting user information. A data ingestion andevent detection pipeline aggregates signals and combines detections ofvarious strengths into truthful events. Thus, normalization increasesevent detection efficiency facilitating event detection closer to “livetime” or at “moment zero”.

Communication signals, including streaming audio signals, as well asother streaming data can be processed in a resource conscious manner toattempt to detect events. When detecting an event from a communicationsignal is more likely based on partial analysis, additional resourcescan be allocated for further processing. On the other hand, whendetecting an event from a communication signal is less likely based onpartial analysis, additional resources are not allocated.

Embodiments of the invention can include any combination and permutationof the various system components and the various method processes,wherein one or more instances of the method and/or processes describedherein can be performed asynchronously (e.g., sequentially),concurrently (e.g., in parallel), or in any other suitable order byand/or using one or more instances of the systems, elements, and/orentities described herein.

The present described aspects may be implemented in other specific formswithout departing from its spirit or essential characteristics. Thedescribed aspects are to be considered in all respects only asillustrative and not restrictive. The scope is, therefore, indicated bythe appended claims rather than by the foregoing description. Allchanges which come within the meaning and range of equivalency of theclaims are to be embraced within their scope.

What is claimed:
 1. A method comprising: ingesting a signal thatincludes sensitive user information; removing at least a portion of thesensitive user information from the signal; subsequent to removing theat least a portion of the sensitive user information, computing a firstscore from a portion of the signal and indicating a likelihood of thesignal including event information related to an event type; determiningprocessing of another signal is warranted based on the indicatedlikelihood; allocating computing resources to process the other signal;computing a second score from parameters associated with the othersignal utilizing the allocated computing resources; and detecting apreviously unidentified event of the event type based on the secondscore.
 2. The method of claim 1, wherein ingestion a signal comprisesingesting a signal that includes one or more of: confidentialinformation, patient information, personally identifiable information(PII), personal health information (PHI), sensitive personal information(SPI), or Payment Card Industry information (PCI).
 3. The method ofclaim 1, wherein removing at least a portion of the sensitive userinformation from the signal comprises removing one or more of:confidential information, patient information, personally identifiableinformation (PII), personal health information (PHI), sensitive personalinformation (SPI), or Payment Card Industry information (PCI) from thesignal.
 4. The method of claim 1, wherein ingesting a signal thatincludes sensitive user information comprises ingesting a signal thatincludes pandemic related information; wherein removing at least aportion of the sensitive user information from the signal comprisesremoving a portion of the pandemic related information; and whereindetecting a previously unidentified event of the event type comprisesdetecting one of: when and where pandemic symptoms are occurring, anindication of tests given and positive diagnoses related to a pandemic,emergency department waiting times, or medical equipment availability.5. The method of claim 1, wherein ingesting a signal comprises ingestinga database signal; wherein computing a first score from a portion of thesignal comprises computing a first score from a portion of the databasesignal; and wherein detecting a previously unidentified event of theevent type comprises detecting an available bed at a treatment facility.6. The method of claim 1, wherein computing a first score from a portionof the signal comprises computing a first score from a portion of a textstream; and wherein computing a second score from parameters associatedwith the other signal comprises computing the second score fromparameters associated with one of: an audio stream, a video stream, or asensor data stream.
 7. The method of claim 1, wherein computing a firstscore from a portion of the signal comprises computing a first scorefrom a portion of a video stream; and wherein computing a second scorefrom parameters associated with the other signal comprises computing thesecond score from parameters associated with one of: an audio stream, atext stream, or a sensor data stream.
 8. The method of claim 1, whereincomputing a first score from a portion of the signal comprises computinga first score from a portion of a sensor data stream; and whereincomputing a second score from parameters associated with the othersignal comprises computing the second score from parameters associatedwith one of: an audio stream, a video stream, or a text stream.
 9. Themethod of claim 1, wherein computing a first score from a portion of thesignal comprises computing the first score subsequent to removing the atleast a portion of the user information.
 10. The method of claim 1,further comprising: accessing the other signal including other userinformation; removing at least a portion of the other user informationfrom the other signal; deriving the parameters associated with the othersignal subsequent to removing the at least a portion of the other userinformation.
 11. A system comprising: a processor; system memory coupledto the processor and storing instructions configured to cause theprocessor to: ingest a signal that includes sensitive user information;remove at least a portion of the sensitive user information from thesignal; subsequent to removing the at least a portion of the sensitiveuser information, compute a first score from a portion of the signal andindicating a likelihood of the signal including event informationrelated to an event type; determine processing of another signal iswarranted based on the indicated likelihood; allocate computingresources to process the other signal; compute a second score fromparameters associated with the other signal utilizing the allocatedcomputing resources; and detect a previously unidentified event of theevent type based on the second score.
 12. The computer system of claim11, wherein instructions configured to ingest a signal compriseinstructions configured to ingest a signal that includes one or more of:confidential information, patient information, personally identifiableinformation (PII), personal health information (PHI), sensitive personalinformation (SPI), or Payment Card Industry information (PCI).
 13. Thesystem of claim 11, wherein instructions configured to remove at least aportion of the sensitive user information from the signal comprisesinstructions configured to remove one or more of: confidentialinformation, patient information, personally identifiable information(PII), personal health information (PHI), sensitive personal information(SPI), or Payment Card Industry information (PCI) from the signal. 14.The system of claim 11, wherein instructions configured to ingest asignal that includes sensitive user information comprise instructionsconfigured to ingest a signal that includes pandemic relatedinformation; wherein instructions configured to remove at least aportion of the sensitive user information from the signal compriseinstructions configured to remove a portion of the pandemic relatedinformation; and wherein instructions configured to detect a previouslyunidentified event of the event type comprise instructions configured todetect one of: when and where pandemic symptoms are occurring, anindication of tests given and positive diagnoses related to a pandemic,emergency department waiting times, or medical equipment availability.15. The system of claim 11, wherein instructions configured to ingest asignal comprise instructions configured to ingest a database signal;wherein instructions configured to compute a first score from a portionof the signal comprise instructions configured to compute a first scorefrom a portion of the database signal; and wherein instructionsconfigured to detect a previously unidentified event of the event typecomprise instructions configured to detect an available bed at atreatment facility.
 16. The system of claim 11, wherein instructionsconfigured to compute a first score from a portion of the signalcomprise instructions configured to compute a first score from a portionof a text stream; and wherein instructions configured to compute asecond score from parameters associated with the other signal comprisesinstructions configured to compute the second score from parametersassociated with one of: an audio stream, a video stream, or a sensordata stream.
 17. The system of claim 11, wherein instructions configuredto compute a first score from a portion of the signal compriseinstructions configured to compute a first score from a portion of avideo stream; and wherein instructions configured to compute a secondscore from parameters associated with the other signal compriseinstructions configured to compute the second score from parametersassociated with one of: an audio stream, a text stream, or a sensor datastream.
 18. The system of claim 11, wherein instructions configured tocompute a first score from a portion of the signal comprise instructionsconfigured to compute a first score from a portion of a sensor datastream; and wherein instructions configured to compute a second scorefrom parameters associated with the other signal comprise instructionsconfigured to compute the second score from parameters associated withone of: an audio stream, a video stream, or a text stream.
 19. Thesystem of claim 11, wherein instructions configured to compute a firstscore from a portion of the signal comprise instructions configured tocompute the first score subsequent to removing the at least a portion ofthe user information.
 20. The system of claim 11, further comprisinginstructions configured to: access the other signal including other userinformation; remove at least a portion of the other user informationfrom the other signal; derive the parameters associated with the othersignal subsequent to removing the at least a portion of the other userinformation.